WP Food Manager < 1.0.4 – Admin+ Stored XSS | CVE 2023-0604 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

1. Go to "Food manager > Add Food" and add an example food
2. Edit the added food and go to Food data -> options / Add ons / Toppings -> Add the following XSS payload: `test"><img src=x onerror=confirm(document.domain)>` and fill out the other fields
3. Publish the food, you will see an XSS got triggered

Affects Plugins

wp-food-manager

Fixed in 1.0.4

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Nithissh Sathish

Submitter

Nithissh Sathish

Submitter website

https://nithissh.com

Verified

Yes

WPVDB ID

4492b5ad-c339-47f5-9003-a9c5f23efdd9

Timeline

Publicly Published

2023-07-17 (about 2 years ago)

Added

2023-07-17 (about 2 years ago)

Last Updated

2023-07-17 (about 2 years ago)

Other

Published

Title

Published

2021-01-05

Title

Stripe Payments < 2.0.40 - Authenticated Stored Cross-Site Scripting (XSS)

Published

2024-08-16

Title

Purity Of Soul <= 1.9 - Reflected Cross-Site Scripting

Published

2023-04-13

Title

Coupon Affiliates < 5.4.6 - Reflected XSS

Published

2025-12-04

Title

WP-SOS-Donate Donation Sidebar Plugin <= 0.9.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']

Published

2023-08-17

Title

Mortgage Calculator Estatik <= 2.0.12 - Reflected XSS