PageLayer < 1.7.8 – Author+ Stored XSS | CVE 2023-5087 | Plugin Vulnerabilities

Description

The plugin doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer code.

Proof of Concept

- As a user with Author+ capabilities, create a new post draft
- Save it, then edit it using the PageLayer page builder
- Navigate to the "Advanced" tab, and then the " Header, Body and Footer" section
- Enter `</textarea><script>alert(1);</script>` in the Header, Body and Footer code text areas, and save. 
- Preview the resulting post should make the alert prompts go off.

Affects Plugins

Fixed in 1.7.8

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Marc Montpas

Submitter

Marc Montpas

Submitter website

https://wpscan.com

Submitter twitter

Verified

Yes

WPVDB ID

3b45cc0b-7378-49f3-900e-d0e18cd4b878

Timeline

Publicly Published

2023-09-25 (about 2 years ago)

Added

2023-09-25 (about 2 years ago)

Last Updated

2023-09-25 (about 2 years ago)

Other

Published

Title

Published

2016-04-12

Title

Tidio Gallery <= 1.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)

Published

2024-11-18

Title

GoQMieruca <= 1.0.0 - Reflected Cross-Site Scripting

Published

2025-01-16

Title

Feedburner Optin Form <= 0.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-09-25

Title

RegistrationMagic < 6.0.2.1 - Stored XSS

Published

2024-05-21

Title

WP Font Awesome Share Icons <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode