WordPress Plugin Vulnerabilities

Content Control < 1.1.10 - Contributor+ Stored XSS

Description

The plugin does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admins.

Proof of Concept

Exploit shortcode:

[content_control class='xss" onmouseover="alert(1)" style="background:red;width:100px;height:100px;" data-more-class="']

Affects Plugins

Plugin icon
content-control
Fixed in 1.1.10

References

CVE
CVE-2022-4509

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Lana Codes
Submitter
Lana Codes
Submitter website
https://lana.codes/
Submitter twitter
LanaCodes
Verified
Yes
WPVDB ID
90baba2e-a64f-4725-b76c-3aed94b18910

Timeline

Publicly Published
2022-12-29 (about 1 years ago)
Added
2022-12-29 (about 1 years ago)
Last Updated
2022-12-29 (about 1 years ago)

Other

Published
Title
Published
2024-05-10
Title
Graphina – Elementor Charts and Graphs < 1.8.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Published
2023-10-29
Title
Simple Shortcodes <= 1.0.20 - Contributor+ Stored Cross-Site Scripting
Published
2018-12-02
Title
WP Mail SMTP by WPForms < 1.4.0 - Authenticated Stored Cross-Site Scripting (XSS)
Published
2023-01-20
Title
Media Library Categories < 2.0.0 - Admin+ Stored XSS
Published
2018-07-17
Title
FV Flowplayer Video Player 6.1.2-6.6.4 - Unspecified Cross-Site Scripting (XSS)