Front Editor < 4.4.5 – Admin+ Stored XSS | CVE 2023-1982 | Plugin Vulnerabilities

Description

The plugin does not sanitize and escape some of its form settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

1. Add a new form.
2. For the "Post Title", add a "Label" of: <img src=x onerror=alert(/XSS/); >, or <script>alert(/XSS/)</script>
3. Save the form.
4. Edit the form and see JavaScript code executed.

Affects Plugins

Fixed in 4.4.5

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Vikas Kumawat

Submitter

Vikas Kumawat

Submitter twitter

Verified

Yes

WPVDB ID

51987966-8007-4e12-bc2e-997b92054739

Timeline

Publicly Published

2023-08-02 (about 2 years ago)

Added

2023-08-02 (about 2 years ago)

Last Updated

2024-10-21 (about 1 year ago)

Other

Published

Title

Published

2024-03-28

Title

Jobeleon Theme < 1.9.2 - Reflected Cross-Site Scripting

Published

2023-09-03

Title

Client Portal : SuiteDash Direct Login < 1.8.0 - Admin+ Stored XSS

Published

2024-06-05

Title

Advanced Woo Labels – Product Labels for WooCommerce < 1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-03-27

Title

Ultimate Dashboard < 3.8.6 - Admin+ Stored XSS

Published

2025-01-28

Title

Simple Image Sizes < 3.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting