Async JavaScript < 2.21.06.29 – Authenticated (admin+) Stored XSS | Plugin Vulnerabilities

Description

The plugin does not validate or escape its Username and API Key from the Wizard tab of its settings, allowing high privilege users such as admin to set JavaScript payload in them, even when the unfiltered_html capability is disallowed, leading to Stored Cross-Site Scripting issues

Proof of Concept

Set the payload below in the Username and API Key fields to the Wizard tab of the settings (wp-admin/options-general.php?page=async-javascript&tab=wizard)

" style=animation-name:rotation onanimationstart=alert(/XSS/)//

Then click on Processed to Step 2 (which generate an error about the Username and key being incorrect), and reload the age to trigger the XSS

Affects Plugins

async-javascript

Fixed in 2.21.06.29

References

URL

https://m0ze.ru/vulnerability/[2021-05-01]-[WordPress]-[CWE-79]-Async-JavaScript-WordPress-Plugin-v2.20.12.09.txt

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

m0ze

Verified

Yes

WPVDB ID

278f7c36-05f8-4b6f-9a13-11175e3f3971

Timeline

Publicly Published

2021-06-13 (about 4 years ago)

Added

2021-06-29 (about 4 years ago)

Last Updated

2022-03-05 (about 3 years ago)

Other

Published

Title

Published

2024-10-17

Title

MAS Companies For WP Job Manager < 1.0.14 - Reflected Cross-Site Scripting

Published

2025-06-05

Title

ESV Bible Shortcode for WordPress <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2021-01-12

Title

Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site Scripting

Published

2024-05-17

Title

Logo Slider < 4.0.0 - Contributor+ Stored XSS

Published

2025-01-02

Title

Plugin Oficial – Getnet para WooCommerce < 1.8.1 - Reflected XSS