Icegram < 2.1.8 – Contributor+ Stored Cross-Site Scripting | CVE 2022-1776 | Plugin Vulnerabilities

Description

The plugin does not sanitize and escape some campaign parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks

Proof of Concept

Create/edit a campaign (such as a Black Friday one), check the "Use Opt-in / Subscription / Lead capture form" settings and put the following payload in the "message_data[6130][form_header]" and "message_data[6130][form_footer]" fields: <img src onerror=alert(/XSS/)>

The XSS will be triggered when viewing/previewing the campaign

Affects Plugins

Fixed in 2.1.8

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Pritam Dash

Submitter

Pritam Dash

Verified

Yes

WPVDB ID

46ed56db-9b9d-4390-80fc-343a01fcc3c9

Timeline

Publicly Published

2022-06-01 (about 3 years ago)

Added

2022-06-01 (about 3 years ago)

Last Updated

2023-03-01 (about 2 years ago)

Other

Published

Title

Published

2023-07-18

Title

Custom Post Type Generator <= 2.4.2 - Admin+ Stored Cross-Site Scripting

Published

2025-01-10

Title

ECT Home Page Products <= 1.9 - Reflected XSS

Published

2021-12-24

Title

Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting

Published

2024-11-08

Title

Fancy User List <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-06-05

Title

Event post < 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting