Responsive Tabs < 4.0.11 – Contributor+ Stored XSS | CVE 2024-4096 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its Tab settings, which could allow high privilege users such as Contributors and above to perform Stored Cross-Site Scripting attacks

Proof of Concept

1. Go to "Tab Sets > Add New"
2. For the tab details title, add the payload: `&lt;img src=x onerror=alert(/XSS/)&gt;`
3. Save and see the XSS
4. When the admin goes to approve the tab, the XSS will triggered

Affects Plugins

responsive-tabs

Fixed in 4.0.11

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Submitter

Krugov Aryom

Submitter website

https://research.cleantalk.org/cve-2024-4096

Verified

Yes

WPVDB ID

4dba5e9e-24be-458a-9150-7c7a958e66cb

Timeline

Publicly Published

2024-07-09 (about 1 year ago)

Added

2024-07-09 (about 1 year ago)

Last Updated

2024-08-23 (about 1 year ago)

Other

Published

Title

Published

2022-12-23

Title

Easy Accordion < 2.2.0 - Contributor+ Stored XSS

Published

2024-10-31

Title

Restaurant & Cafe Addon for Elementor < 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2023-02-02

Title

Print Invoice & Delivery Notes for WooCommerce < 4.7.2 - Reflected XSS

Published

2014-08-01

Title

Verification Code for Comments 2.1.0 - vcc.js.php Multiple Parameter Reflected XSS

Published

2024-10-03

Title

Login Logout Shortcode <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter