WordPress Plugin Vulnerabilities

WP Dialog <= 1.2.5.5 - Authenticated Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some of its settings before outputting them in pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Proof of Concept

Put the following payload in the Welcome message (st_content parameter) of the plugin:

</script><img src onerror=alert(/XSS/)> to trigger the XSS in any frontend page
</textarea><img src onerror=alert(/XSS/)> to trigger the XSS in the plugin's settings

https://github.com/liaojia-99/my-creat-cve/blob/main/1.md

Affects Plugins

Plugin icon
wp-dialog
No known fix

References

CVE
CVE-2021-24600

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
liaojia@webray.com.cn inc
Submitter
liaojia@webray.com.cn inc
Verified
Yes
WPVDB ID
413b3a2e-1c05-45ec-b00f-1c137a1ae33e

Timeline

Publicly Published
2021-07-31 (about 2 years ago)
Added
2021-08-19 (about 2 years ago)
Last Updated
2022-03-07 (about 2 years ago)

Other

Published
Title
Published
2023-01-12
Title
Quick Event Manager < 9.7.5 - Reflected Cross-Site
Published
2024-04-24
Title
WP Shortcodes Plugin — Shortcodes Ultimate < 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox
Published
2021-09-09
Title
WordPress InviteBox Plugin <= 1.4.1 - Reflected Cross-Site Scripting
Published
2023-11-09
Title
Advanced iFrame < 2023.9 - Contributor+ Stored XSS
Published
2021-09-09
Title
Integration of Moneybird for WooCommerce <= 2.1.1 - Reflected Cross-Site Scripting