Multiple Plugins – Cross-Site Scripting From Third-party Library | CVE 2023-1119 | Plugin Vulnerabilities

Description

The plugins use a third-party library that removes the escaping on some HTML characters, leading to a cross-site scripting vulnerability.

Proof of Concept

WP-Optimize - Reflected Cross-Site Scripting

1. Go to the plugin settings and in the "Images" section check the box "Create WebP version of image".
2. Visit the page: /?s=<script>alert(/XSS/)</script>

SrbTransLatin - Contributor+ Stored Cross-Site Scripting

1. Create a post and add the following content: <script>alert(/XSS/)</script>
2. Load the post on the frontend, and see the XSS alert.

Affects Plugins

Fixed in 3.2.13

Fixed in 2.4.1

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Paolo Elia

Submitter

Paolo Elia

Verified

Yes

WPVDB ID

2e78735a-a7fc-41fe-8284-45bf451eff06

Timeline

Publicly Published

2023-06-19 (about 2 years ago)

Added

2023-06-19 (about 2 years ago)

Last Updated

2023-08-14 (about 2 years ago)

Other

Published

Title

Published

2016-06-09

Title

CM Ad Changer <= 1.7.7 - Stored Cross-Site Scripting (XSS)

Published

2025-01-02

Title

Spiritual Gifts Survey <= 0.9.10 - Unauthenticated CSRF to XSS

Published

2022-07-05

Title

Advanced WordPress Reset < 1.6 - Reflected Cross-Site Scripting

Published

2024-02-08

Title

Royal Elementor Addons and Templates < 1.3.88 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-04-29

Title

Social Media Share Buttons < 2.9.0 - Admin+ Stored XSS