WordPress Plugin Vulnerabilities
Async JavaScript < 2.21.06.29 - Authenticated (admin+) Stored XSS
Description
The plugin does not validate or escape its Username and API Key from the Wizard tab of its settings, allowing high privilege users such as admin to set JavaScript payload in them, even when the unfiltered_html capability is disallowed, leading to Stored Cross-Site Scripting issues
Proof of Concept
Set the payload below in the Username and API Key fields to the Wizard tab of the settings (wp-admin/options-general.php?page=async-javascript&tab=wizard) " style=animation-name:rotation onanimationstart=alert(/XSS/)// Then click on Processed to Step 2 (which generate an error about the Username and key being incorrect), and reload the age to trigger the XSS
Affects Plugins
Fixed in version 2.21.06.29
References
Classification
Miscellaneous
Timeline
Publicly Published
2021-06-13 (about 1 years ago)
Added
2021-06-29 (about 1 years ago)
Last Updated
2022-03-05 (about 1 years ago)