WordPress Plugin Vulnerabilities

IURNY by INDIGITALL < 3.2.3 - Admin+ Stored XSS

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

1. Go to the plugin's settings.
2. Insert this payload in any of the vulnerable fields (Bubble Text, Header, Chat Text, Button Text): <svg/onload=alert(/XSS/)>
3. Save settings and enable the widget.
4. Browse the homepage and the alert will trigger.

Affects Plugins

Plugin icon
indigitall-web-push-notifications
Fixed in 3.2.3

References

CVE
CVE-2023-3647

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.4 (low)

Miscellaneous

Original Researcher
Dipak Panchal (th3.d1pak)
Submitter
Dipak Panchal (th3.d1pak)
Verified
Yes
WPVDB ID
6df05333-b1f1-4324-a1ba-dd36fbf1778c

Timeline

Publicly Published
2023-07-24 (about 9 months ago)
Added
2023-07-24 (about 9 months ago)
Last Updated
2023-07-24 (about 9 months ago)

Other

Published
Title
Published
2021-08-09
Title
Form Builder < 1.9.8.4 - Authenticated Stored Cross-Site Scripting
Published
2016-08-22
Title
Akal Theme - Reflected Cross-Site Scripting (XSS)
Published
2022-08-01
Title
Download Manager < 3.2.49 - Contributor+ Stored Cross-Site Scripting
Published
2023-01-19
Title
Easy PayPal Buy Now Button < 1.7.4 - Contributor+ Stored XSS in Shortcode
Published
2014-08-01
Title
S3 Video <= 0.97 - VideoJS Cross Site Scripting