WordPress Plugin Vulnerabilities

StoryChief < 1.0.31 - Authenticated Stored Cross-Site Scripting (XSS)

Description

The plugin does not sanitise and escape its StoryChief Key setting before outputting it in an attribute, leading to an Authenticated Stored Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
story-chief
Fixed in 1.0.31

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
2a169240-3f0f-44d5-859d-08941dd848be

Timeline

Publicly Published
2021-08-02 (about 4 years ago)
Added
2021-08-02 (about 4 years ago)
Last Updated
2021-08-02 (about 4 years ago)

Other

Published
Title
Published
2023-02-14
Title
Opt-Out for Google Analytics < 2.3.5 - Admin+ Stored XSS
Published
2025-08-29
Title
Ocean Extra < 2.5.0 - Contributor+ Stored XSS
Published
2025-08-18
Title
Flexible Maps < 1.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flexible Maps Shortcode
Published
2025-08-19
Title
Comments Capcha Box <= 1.1 - Reflected Cross-Site Scripting
Published
2023-04-12
Title
hiWeb Migration Simple <= 2.0.0.1 Reflected Cross-Site Scripting