WordPress Plugin Vulnerabilities

GeoDirectory < 2.2.22 - Contributor+ Stored XSS via Shortcode

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Proof of Concept

Note: First, you need to add a Place, and the id is the post id of the previously added place, and the key is the meta key.

Exploit shortcode:

[gd_post_meta id='1' key='city' css_class='" onmouseover="alert(1)" style="background:red;"']

Affects Plugins

Plugin icon
geodirectory
Fixed in 2.2.22

References

CVE
CVE-2022-4775

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Lana Codes
Submitter
Lana Codes
Submitter website
https://lana.codes/
Submitter twitter
LanaCodes
Verified
Yes
WPVDB ID
5ab3fc58-7d1c-4bcd-8bbd-86c62a3f979c

Timeline

Publicly Published
2022-12-29 (about 11 months ago)
Added
2022-12-29 (about 11 months ago)
Last Updated
2022-12-29 (about 11 months ago)

Other

Published
Title
Published
2020-06-11
Title
WordPress < 5.4.2 - Authenticated XSS via Media Files
Published
2021-09-09
Title
YouTube Video Inserter <= 1.2.1.0 - Reflected Cross-Site Scripting
Published
2023-11-06
Title
Featured Image Caption < 0.8.11 - Contributor+ Stored XSS
Published
2022-05-16
Title
Photo Gallery < 1.6.4 - Admin+ Stored Cross-Site Scripting
Published
2022-12-24
Title
Store Locator WordPress < 1.4.9 - Contributor+ Stored XSS via Shortcode