WordPress Plugin Vulnerabilities

Category Posts Widget (Free < 4.9.17, Pro < 4.9.13) - Admin+ Stored XSS

Description

The plugin does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the Widget is embed, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

Affects Plugins

Plugin icon
category-posts
Fixed in 4.9.17
Plugin icon
term-and-category-based-posts-widget
Fixed in 4.9.13

References

CVE
CVE-2024-6158
URL
https://research.cleantalk.org/cve-2024-6158/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.4 (low)

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Submitter
Dmitrii Ignatyev
Submitter website
https://www.linkedin.com/in/dmitriy-ignatyev-8a9189267/
Verified
Yes
WPVDB ID
8adb219f-f0a6-4e87-8626-db26e300c220

Timeline

Publicly Published
2024-07-19 (about 1 year ago)
Added
2024-07-19 (about 1 year ago)
Last Updated
2024-07-19 (about 1 year ago)

Other

Published
Title
Published
2023-02-02
Title
WP Booking System < 2.0.18.1 - Admin+ Stored XSS
Published
2015-08-13
Title
Kiwi Logo Carousel <= 1.7.1 - Authenticated Cross-Site Scripting (XSS)
Published
2024-10-29
Title
Widget or Sidebar Shortcode <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2023-10-16
Title
Theme Switcha < 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2025-02-03
Title
Image Rotator <= 2.0 - Reflected Cross-Site Scripting