WordPress Plugin Vulnerabilities

Themify Shortcodes < 2.0.8 - Contributor+ Stored XSS via Shortcode

Description

The plugin does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.

Proof of Concept

Exploit shortcode:

[themify_button color='red" onmouseover="alert(1)"']XSS[/themify_button]

Affects Plugins

Plugin icon
themify-shortcodes
Fixed in 2.0.8

References

CVE
CVE-2022-4787

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Lana Codes
Submitter
Lana Codes
Submitter website
https://lana.codes/
Submitter twitter
LanaCodes
Verified
Yes
WPVDB ID
2ab59972-ccfd-48f6-b879-58fb38823ca5

Timeline

Publicly Published
2023-01-04 (about 1 years ago)
Added
2023-01-04 (about 1 years ago)
Last Updated
2023-01-04 (about 1 years ago)

Other

Published
Title
Published
2023-06-19
Title
Enable SVG Uploads <= 2.1.5 - Author+ Stored XSS via SVG
Published
2022-02-02
Title
CP Blocks < 1.0.15 - Admin+ Stored Cross-Site Scripting
Published
2021-06-30
Title
WP SMS < 5.4.9.1 - Reflected Cross-Site Scripting (XSS)
Published
2023-10-23
Title
Live Chat with Facebook Messenger < 1.0 - Contributor+ Stored XSS via Shortcode
Published
2022-04-11
Title
Responsive Tabs < 4.0.6 - Author+ Stored Cross-Site Scripting