Ko-fi Button < 1.3.3 – Admin+ Stored XSS | CVE 2023-2254 | Plugin Vulnerabilities

Description

The plugin does not properly some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup), and we consider it a low risk.

Proof of Concept

1. In the Kofi plugin settings, change the "Button Text" field to: `<img src=x onerror=alert(1)>`
2. Add the [kofi] tag to one of your pages
3. View that page and see the XSS

Affects Plugins

Fixed in 1.3.3

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Felipe Restrepo Rodriguez

Submitter

Felipe Restrepo Rodriguez

Submitter website

https://pfelilpe.com

Submitter twitter

Verified

Yes

WPVDB ID

8886ec5f-8465-448f-adbd-68a3e84c5dec

Timeline

Publicly Published

2023-04-25 (about 2 years ago)

Added

2023-04-25 (about 2 years ago)

Last Updated

2023-04-25 (about 2 years ago)

Other

Published

Title

Published

2023-02-14

Title

Client Logo Carousel <= 3.0.0 - Contributor+ Stored XSS

Published

2024-11-08

Title

OSM – OpenStreetMap < 6.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-01-07

Title

Mind Doodle Visual Sitemaps & Tasks <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-08-13

Title

Gutenberg Blocks, Page Builder – ComboBlocks < 2.2.88 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Block

Published

2025-03-31

Title

Custom Database Applications by Caspio <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting