Custom Share Buttons with Floating Sidebar < 4.2 – Admin+ Stored XSS | CVE 2022-1717 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed

Proof of Concept

Put the following payload in any of the Floating Sidebar > Share on xxxx (such as Share on Facebook) settings: " autofocus onfocus=alert(/XSS/)// and save

The XSS will be triggered when viewing the plugin's settings again, as well as in the frontend when the Sidebar and the related Social Share button (tick the checkboxes in the General settings) are active

All settings appear to also lack sanitisation and escaping

Affects Plugins

custom-share-buttons-with-floating-sidebar

Fixed in 4.2

References

CVE

URL

https://www.hackpertise.com/cve/38-cve-2022-1717/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Asif Nawaz Minhas

Submitter

Asif Nawaz Minhas

Verified

Yes

WPVDB ID

79a532e9-bc6e-4722-8d67-9c15720d06a6

Timeline

Publicly Published

2022-05-26 (about 3 years ago)

Added

2022-05-26 (about 3 years ago)

Last Updated

2023-02-21 (about 2 years ago)

Other

Published

Title

Published

2024-12-06

Title

TWChat – Send or receive messages from users <= 4.0.4 - Reflected Cross-Site Scripting

Published

2023-06-26

Title

ApplyOnline < 2.5.6 - Admin+ Stored XSS

Published

2023-06-19

Title

Enable SVG Uploads <= 2.1.5 - Author+ Stored XSS via SVG

Published

2024-03-28

Title

Fluent CRM < 2.8.45 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2022-11-25

Title

Community Events < 1.4.9 - Admin+ Stored XSS