WordPress Plugin Vulnerabilities
Easy Forms for MailChimp < 6.8.7 - Contributor+ Stored XSS
Description
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Proof of Concept
As a contributor, put the below shortcodes in a post, preview it and move the mouse over the generated subscribe form to trigger the XSS [yikes-mailchimp-unsubscribe list='"onmouseover=alert(/XSS-list/)//'] [yikes-mailchimp-unsubscribe list='-1' email_placeholder='"onmouseover=alert(/XSS-email_placeholder/)//']
Affects Plugins
Fixed in 6.8.7 References
CVE
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Erwan LR (WPScan)
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2023-03-27 (about 1 years ago)
Added
2023-03-27 (about 1 years ago)
Last Updated
2023-03-27 (about 1 years ago)
WPScan 