WordPress Plugin Vulnerabilities

Profile Box Shortcode And Widget < 1.2.1 - Admin+ Stored XSS

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

When creating a new widget, insert the following payload in the "Max width" field: `250" onmouseover="alert(/XSS/)"`

View the site on the frontend to see the XSS

Affects Plugins

Plugin icon
facebook-likebox-widget-and-shortcode
Fixed in 1.2.1

References

CVE
CVE-2024-1401
URL
https://research.cleantalk.org/cve-2024-1401/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Submitter
Dmitrii Ignatyev
Submitter website
https://research.cleantalk.org
Verified
Yes
WPVDB ID
91064ba5-cf65-46e6-88df-0e4d96a3ef9f

Timeline

Publicly Published
2024-02-27 (about 2 months ago)
Added
2024-02-27 (about 2 months ago)
Last Updated
2024-03-12 (about 1 months ago)

Other

Published
Title
Published
2016-11-13
Title
Gallery - Video Gallery <= 2.0.3 - Cross-Site Scripting (XSS) & CSRF
Published
2024-02-26
Title
postMash – custom post order <= 1.2.0 - Reflected Cross-Site Scripting via m
Published
2023-08-22
Title
Vertical Marquee <= 7.2 - Admin+ Stored XSS
Published
2022-07-07
Title
Copyright Proof <= 4.16 - Reflected Cross-Site-Scripting
Published
2020-07-13
Title
Workio – Job Board < 1.0.3 - Unauthenticated Reflected XSS