Remove Footer Credit < 1.0.11 – Admin+ Stored Cross-Site Scripting | CVE 2021-25050 | Plugin Vulnerabilities

Description

The plugin does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.

Proof of Concept

In the plugin's settings, put the following values:

- In "Step 1: Enter text/HTML to remove (one per line)" field: powered
- In "Step 2: Enter your own footer credit (one per line)": ">--><img src onerror=alert(/XSS/)>

The XSS will be triggered in all pages

Affects Plugins

remove-footer-credit

Fixed in 1.0.11

References

CVE

URL

https://plugins.trac.wordpress.org/changeset/2655918

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

apple502j

Submitter

apple502j

Verified

Yes

WPVDB ID

25a28adb-794f-4bdb-89e8-060296b45b38

Timeline

Publicly Published

2022-01-12 (about 3 years ago)

Added

2022-01-11 (about 3 years ago)

Last Updated

2022-04-12 (about 3 years ago)

Other

Published

Title

Published

2025-09-09

Title

My Tickets < 2.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-04-01

Title

MX Time Zone Clocks <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2014-08-01

Title

Uploadify Integration 0.9.6 - Multiple Cross Site Scripting Vulnerabilities

Published

2014-10-07

Title

Titan Framework 1.0.1-1.5.2 - Reflected Cross-Site Scripting (XSS)

Published

2024-04-25

Title

WPZOOM Addons for Elementor (Templates, Widgets) <= <=1.1.35 - Authenticated (Contributor+) Stored Cross-Site Scripting