NewStatPress < 1.0.6 – Reflected Cross-Site Scripting (XSS) | CVE 2015-9312 | Plugin Vulnerabilities

Description

The NewStatPress plugin utilizes on lines 28 and 31 of the file ‘includes/nsp_search.php’ several variables from the $_GET scope, without sanitation. While WordPress automatically escapes quotes on this scope, the outputs on these lines are outside of quotes, and as such can be utilized to trigger a Reflected XSS attack.

Proof of Concept

The following URL will trigger an alert box in FireFox when visited, should the user be logged in as an Administrative user.

http://localhost/wp-admin/admin.php?groupby1=checked%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29&page=nsp_search&newstatpress_action=search

Affects Plugins

Fixed in 1.0.6

References

CVE

URL

https://g0blin.co.uk/g0blin-00057/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Submitter

James Hooker

Submitter website

https://research.g0blin.co.uk

Submitter twitter

Verified

No

WPVDB ID

46bf6c69-b612-4aee-965d-91f53f642054

Timeline

Publicly Published

2015-07-07 (about 10 years ago)

Added

2015-07-07 (about 10 years ago)

Last Updated

2020-09-22 (about 5 years ago)

Other

Published

Title

Published

2024-02-05

Title

WP 404 Auto Redirect to Similar Post < 1.0.4 - Reflected Cross-Site Scripting via request

Published

2024-02-20

Title

Scalable Vector Graphics (SVG) <= 3.4 - Author+ Stored XSS via SVG

Published

2020-04-03

Title

OneTone <= 3.0.6 - Unauthenticated Stored Cross-Site Scripting (XSS)

Published

2024-11-08

Title

Bamboo Enquiries <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2020-06-25

Title

Coming Soon Page, Under Construction & Maintenance Mode by SeedProd < 5.1.2 - Authenticated Stored Cross Site Scripting (XSS)