WordPress Plugin Vulnerabilities

Jetpack CRM < 5.5.1 - CRM Admin+ XSS

Description

The plugin does not sanitise and escape the tax rate field and custom field placeholders, which could allow CRM Admin users to perform Cross-Site Scripting attacks against site Admins.

Affects Plugins

Plugin icon
zero-bs-crm
Fixed in 5.5.1

References

URL
https://hackerone.com/reports/1806200
URL
https://hackerone.com/reports/1806199

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
foobar7
Verified
No
WPVDB ID
2adf88a6-70b8-4923-a24f-b613bf3b5c2b

Timeline

Publicly Published
2023-09-12 (about 8 months ago)
Added
2023-09-12 (about 8 months ago)
Last Updated
2023-09-12 (about 8 months ago)

Other

Published
Title
Published
2019-09-08
Title
Reality < 2.4.0 - Multiple Persistent XSS
Published
2022-03-21
Title
Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site Scripting
Published
2021-07-27
Title
uListing < 2.0.6 - Reflected Cross-Site Scripting
Published
2021-03-17
Title
Elementor < 3.1.4 - Authenticated Stored Cross-Site Scripting (XSS) in Heading Widget
Published
2024-04-25
Title
ColorNews < 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting