Bulk Edit and Create User Profiles < 1.5.14 – Admin+ Stored Cross-Site Scripting | CVE 2022-1089 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape the Users Login, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Proof of Concept

Edit a user via the plugin's feature (/wp-admin/admin.php?page=vgse-bulk-edit-user), add the following payload in the Login Column, then save: "><img src onerror=prompt(/XSS/)>

The XSS will be trigged when opening the Edit Users page again

Affects Plugins

bulk-edit-user-profiles-in-spreadsheet

Fixed in 1.5.14

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Ankur Bakre

Submitter

Ankur Bakre

Submitter website

https://www.linkedin.com/in/ankur-bakre-99320316b/

Verified

Yes

WPVDB ID

75a9fd23-7fa9-4cb1-a55b-ec5deae5d6fa

Timeline

Publicly Published

2022-04-19 (about 3 years ago)

Added

2022-04-19 (about 3 years ago)

Last Updated

2022-04-19 (about 3 years ago)

Other

Published

Title

Published

2024-09-30

Title

Loggedin – Limit Active Logins < 1.3.2 - Reflected Cross-Site Scripting

Published

2024-11-04

Title

Master Bar <= 1.0 - Reflected Cross-Site Scripting

Published

2021-11-11

Title

Caldera forms < 1.9.5 - Admin+ Stored Cross-Site Scripting

Published

2022-11-14

Title

WordPress Countdown Widget < 3.1.9.3 - Admin+ Stored XSS

Published

2024-01-17

Title

WP Recipe Maker < 9.1.1 - Contributor+ Stored Cross-Site Scripting via Shortcode