Ko-fi Button < 1.3.3 – Admin+ Stored XSS | CVE 2023-2254 | Plugin Vulnerabilities

Description

The plugin does not properly some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup), and we consider it a low risk.

Proof of Concept

1. In the Kofi plugin settings, change the "Button Text" field to: `<img src=x onerror=alert(1)>`
2. Add the [kofi] tag to one of your pages
3. View that page and see the XSS

Affects Plugins

Fixed in 1.3.3

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Felipe Restrepo Rodriguez

Submitter

Felipe Restrepo Rodriguez

Submitter website

https://pfelilpe.com

Submitter twitter

Verified

Yes

WPVDB ID

8886ec5f-8465-448f-adbd-68a3e84c5dec

Timeline

Publicly Published

2023-04-25 (about 2 years ago)

Added

2023-04-25 (about 2 years ago)

Last Updated

2023-04-25 (about 2 years ago)

Other

Published

Title

Published

2021-12-28

Title

WP-DownloadManager < 1.68.7 - Reflected Cross-Site Scripting

Published

2021-06-28

Title

Steam Group Viewer <= 2.1 - Authenticated Stored Cross-Site Scripting (XSS)

Published

2025-04-24

Title

eForm < 4.19 - Unauthenticated Stored Cross-Site Scripting

Published

2022-06-03

Title

Form - Contact Form <= 1.2.4 - Admin+ Stored Cross-Site Scripting

Published

2024-06-20

Title

Ultimate Blocks < 3.1.9 - Contributor+ Stored XSS