WordPress Plugin Vulnerabilities

Popup4Phone <= 1.3.2 - Editor+ Stored XSS

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

1. Go to "Popup4Phone > Settings > Form"
2. In the "Message for show during form submission" field add the payload `</textarea><script>alert(/XSS: popup4phone_form_message_sending/)</script>`
3. Save the changed and view the form on the frontend to see the XSS

Affects Plugins

Plugin icon
popup4phone
No known fix

References

CVE
CVE-2024-3580

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Original Researcher
Bob Matyas
Submitter
Bob Matyas
Submitter website
https://www.bobmatyas.com
Submitter twitter
bobmatyas
Verified
Yes
WPVDB ID
31f401c4-735a-4efb-b81f-ab98c00c526b

Timeline

Publicly Published
2024-04-26 (about 2 months ago)
Added
2024-04-26 (about 1 months ago)
Last Updated
2024-04-26 (about 1 months ago)

Other

Published
Title
Published
2024-06-10
Title
Custom Field Template < 2.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
Published
2024-03-06
Title
Prime Slider – Addons For Elementor < 3.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fiestar Widget
Published
2024-05-15
Title
Rank Math SEO with AI Best SEO Tools < 1.0.219-beta - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-05-02
Title
Custom 404 Pro < 3.7.3 - Reflected Cross-Site Scripting
Published
2021-07-27
Title
Favicon by RealFaviconGenerator < 1.3.22 - Reflected Cross-Site Scripting (XSS)