WordPress Plugin Vulnerabilities
Multiple Plugins - Cross-Site Scripting From Third-party Library
Description
The plugins use a third-party library that removes the escaping on some HTML characters, leading to a cross-site scripting vulnerability.
Proof of Concept
WP-Optimize - Reflected Cross-Site Scripting 1. Go to the plugin settings and in the "Images" section check the box "Create WebP version of image". 2. Visit the page: /?s=<script>alert(/XSS/)</script> SrbTransLatin - Contributor+ Stored Cross-Site Scripting 1. Create a post and add the following content: <script>alert(/XSS/)</script> 2. Load the post on the frontend, and see the XSS alert.
Affects Plugins
References
CVE
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Paolo Elia
Submitter
Paolo Elia
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2023-06-19 (about 5 months ago)
Added
2023-06-19 (about 5 months ago)
Last Updated
2023-08-14 (about 3 months ago)