WordPress Plugin Vulnerabilities

RafflePress Lite < 1.12.14 - Editor+ Stored XSS

Description

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks

Proof of Concept

The PoC will be displayed on July 06, 2024, to give users the time to update.

Affects Plugins

Plugin icon
rafflepress
Fixed in 1.12.14

References

CVE
CVE-2024-3963
YouTube Video

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Original Researcher
Krugov Aryom
Submitter
Krugov Aryom
Verified
Yes
WPVDB ID
827d738e-5369-431e-8438-b5c4d8c1f8f1

Timeline

Publicly Published
2024-06-22 (about 8 days ago)
Added
2024-06-22 (about 8 days ago)
Last Updated
2024-06-22 (about 8 days ago)

Other

Published
Title
Published
2024-05-20
Title
Move Addons for Elementor < 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Published
2022-03-21
Title
Easy Social Icons < 3.2.1 - Admin+ Stored Cross-Site Scripting in add icon
Published
2022-05-10
Title
Easy FAQ with Expanding Text <= 3.2.8.3.1 - Admin+ Stored Cross-Site Scripting
Published
2023-11-23
Title
Events Manager < 6.4.6 - Reflected Cross-Site Scripting
Published
2021-12-03
Title
Modern Events Calendar Lite < 6.2.0 - Subscriber+ Category Add Leading to Stored XSS