Keap Official Opt-in Forms < 1.0.12 – Admin+ Stored XSS | CVE 2023-6941 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).

Proof of Concept

1. Store the script in non-sanitized fields like 'Opt in title', 'Opt in message', and 'Success Message text': <script>alert("Wild (field) appeared!")</script>
2. Visit the website, and then the script gets executed.

Affects Plugins

infusionsoft-official-opt-in-forms

Fixed in 1.0.12

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

MINGYOUNG BAN

Submitter

MINGYOUNG BAN

Submitter website

https://tara7004.tistory.com/

Verified

Yes

WPVDB ID

58f7c9aa-5e59-468f-aba9-b15e7942fd37

Timeline

Publicly Published

2023-12-21 (about 2 years ago)

Added

2023-12-21 (about 2 years ago)

Last Updated

2025-04-02 (about 9 months ago)

Other

Published

Title

Published

2022-12-16

Title

Vision Interactive For WordPress < 1.5.4 - Contributor+ Stored XSS

Published

2023-02-15

Title

Quick Paypal Payments < 5.7.26 - Contributor+ Stored XSS

Published

2023-01-25

Title

Opening Hours <= 2.3.0 - Contributor+ Stored XSS via Shortcode

Published

2025-09-09

Title

My Tickets < 2.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-04-22

Title

List Last Changes < 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting