WordPress Plugin Vulnerabilities

TemplatesNext ToolKit < 3.2.8 - Contributor+ Stored XSS via Shortcode

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

[tx_heading margin='" onmouseover="alert(/XSS/)"']

Affects Plugins

Plugin icon
templatesnext-toolkit
Fixed in 3.2.8

References

CVE
CVE-2022-4678

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Lana Codes
Submitter
Lana Codes
Submitter website
https://lana.codes/
Submitter twitter
LanaCodes
Verified
Yes
WPVDB ID
6a36d665-a0ca-4346-8e55-cf9ba45966cc

Timeline

Publicly Published
2023-01-17 (about 1 years ago)
Added
2023-01-17 (about 1 years ago)
Last Updated
2023-01-17 (about 1 years ago)

Other

Published
Title
Published
2022-01-05
Title
SupportCandy < 2.2.7 - Contributor+ Stored Cross-Site Scripting
Published
2023-01-11
Title
WPFunnels < 2.6.9 - Contributor+ Stored XSS
Published
2024-04-10
Title
Advanced Cron Manager – debug & control < 2.5.3 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2018-01-11
Title
SrbTransLatin <= 1.46 - Stored XSS & CSRF
Published
2014-10-21
Title
NEX-Forms Lite <= 2.1.0 - Stored Cross-Site Scripting (XSS)