WordPress Plugin Vulnerabilities

No Future Posts <= 1.4 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed

Proof of Concept

Affects Plugins

Plugin icon
no-future-posts
No known fix

References

CVE
CVE-2022-1387

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.4 (low)

Miscellaneous

Original Researcher
Vinay Varma Mudunuri, Krishna Harsha Kondaveeti
Submitter
Vinay Varma Mudunuri
Verified
Yes
WPVDB ID
48252ffb-f21c-4e2a-8f78-bdc7164e7347

Timeline

Publicly Published
2022-05-09 (about 3 years ago)
Added
2022-05-09 (about 3 years ago)
Last Updated
2022-05-10 (about 3 years ago)

Other

Published
Title
Published
2021-09-13
Title
SEO Redirection < 7.4 - Reflected Cross-Site Scripting
Published
2023-03-17
Title
Bookly < 21.6 - Unauthenticated Stored XSS
Published
2022-11-10
Title
WP Page Builder <= 1.2.8 - Admin+ Stored Cross-Site
Published
2022-10-24
Title
2kb Amazon Affiliates Store <= 2.1.5 - Reflected XSS
Published
2022-04-27
Title
Curtain <= 1.0.2 - Admin+ Stored Cross-Site Scripting