WordPress Plugin Vulnerabilities

URL Shortify < 1.7.0 - Admin+ Cross Site Scripting

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

1. Navigate to "URL Shortify > Settings > Links"
2. Add `"><script>alert(1)</script>` to the "Link Prefix" and save.
3. Go to "Links > Add New" to see the XSS.

Affects Plugins

Plugin icon
url-shortify
Fixed in 1.7.0

References

CVE
CVE-2023-3129

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Bob Matyas
Submitter
Bob Matyas
Submitter website
https://www.bobmatyas.com
Submitter twitter
@bobmatyas
Verified
Yes
WPVDB ID
5717d729-c24b-4415-bb99-fcdd259328c4

Timeline

Publicly Published
2023-06-19 (about 5 months ago)
Added
2023-06-19 (about 5 months ago)
Last Updated
2023-06-19 (about 5 months ago)

Other

Published
Title
Published
2022-03-15
Title
Post Grid < 2.1.16 - Reflected Cross-Site Scripting via post_types
Published
2023-11-07
Title
Edit WooCommerce Templates <= 1.1.1 - Reflected XSS
Published
2023-02-15
Title
WordPress Social Login and Register < 7.5.15 - Multiple CSRF
Published
2022-08-09
Title
Social Slider Feed < 2.0.7 - Admin+ Stored XSS via Feeds
Published
2022-08-22
Title
Post SMTP < 2.1.4 - Admin+ Stored Cross-Site Scripting