Goodlayers Core < 2.0.10 – Contributor+ Stored XSS | CVE 2024-11357 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

1. As a contributor user, add a new post
2. Add the Goodlayers Accordion Element (others are also affected)
3. Edit the Accordion
4. Change the title to `"><script>alert(/heading-text/)</script>`
5. Click "Save Options"
6. Save the post as a draft
7. Preview and see the XSS alert. It will also display for admins reviewing the post.

Affects Plugins

goodlayers-core

Fixed in 2.0.10

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Bob Matyas

Submitter

Bob Matyas

Submitter website

https://www.bobmatyas.com

Submitter twitter

Verified

Yes

WPVDB ID

7e8c6816-9b7a-43e8-9508-789c8051dd9b

Timeline

Publicly Published

2024-12-12 (about 1 year ago)

Added

2024-12-12 (about 1 year ago)

Last Updated

2024-12-12 (about 1 year ago)

Other

Published

Title

Published

2024-03-18

Title

WPB Show Core < 2.7 - Reflected XSS

Published

2020-08-10

Title

Admin Menu <= 1.1 - Authenticated Cross-Site Scripting (XSS)

Published

2025-08-22

Title

Ogulo – 360° Tour < 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parameter

Published

2025-01-16

Title

CAMOO SMS <= 3.0.1 - Reflected Cross-Site Scripting

Published

2024-07-06

Title

WordPress Notification Bar <= 1.3.10 - Authenticated (Administrator+) Stored Cross-Site Scripting