WordPress Plugin Vulnerabilities

Plezi < 1.0.3 - Unauthenticated Stored XSS

Description

The plugin has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable option, which is then displayed in the admin panel without sanitisation and escaping, leading to a Stored Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
plezi
Fixed in 1.0.3

References

CVE
CVE-2022-0680

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Brandon James Roldan
Submitter
Brandon James Roldan
Submitter twitter
tomorrowisnew_
Verified
Yes
WPVDB ID
7cede02e-9af7-4f50-95a8-84ef4c7f7ded

Timeline

Publicly Published
2022-03-07 (about 3 years ago)
Added
2022-03-07 (about 3 years ago)
Last Updated
2022-04-08 (about 3 years ago)

Other

Published
Title
Published
2025-01-16
Title
SC Simple Zazzle <= 1.1.6 - Reflected Cross-Site Scripting
Published
2024-08-26
Title
Delicious Recipes – WordPress Recipe Plugin < 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-07-08
Title
oik < 4.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via bw_button Shortcode
Published
2014-06-12
Title
Walk Score <= 0.5.5 - Multiple XSS
Published
2023-05-11
Title
10WebSocial < 1.2.9 - Reflected XSS