WordPress Plugin Vulnerabilities

Widget for Social Page Feeds < 6.4 - Admin+ Stored XSS

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

1. Create a new Facebook like widget.
2. When creating a new widget, insert the following payload in the "Custom CSS" field: `background-color: pink; height: 500px;" onmouseover="alert(/XSS/)"`
3. Save and load the site. Move your mouse over the pink box in the widget area and see the XSS pop-up.

Affects Plugins

Plugin icon
facebook-pagelike-widget
Fixed in 6.4

References

CVE
CVE-2024-0973
URL
https://research.cleantalk.org/cve-2024-0973/
YouTube Video

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Submitter
Dmitrii Ignatyev
Submitter website
https://research.cleantalk.org
Verified
Yes
WPVDB ID
798de421-4814-46a9-a055-ebb95a7218ed

Timeline

Publicly Published
2024-02-21 (about 2 months ago)
Added
2024-02-21 (about 2 months ago)
Last Updated
2024-03-04 (about 1 months ago)

Other

Published
Title
Published
2015-10-01
Title
Jetpack <= 3.7.0 - Stored Cross-Site Scripting (XSS)
Published
2024-03-29
Title
PDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2015-07-09
Title
GD bbPress Attachments <= 2.2 - Authenticated Reflected Cross-Site Scripting (XSS)
Published
2024-01-26
Title
(Simply) Guest Author Name < 4.35 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-09-19
Title
File Manager Pro < 1.8.1 - Admin+ Stored Cross-Site Scripting