WordPress Plugin Vulnerabilities

Starbox < 3.5.0 - Contributor+ Stored XSS

Description

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks

Proof of Concept

http://132" onmouseover='alert(1)'

Affects Plugins

Plugin icon
starbox
Fixed in 3.5.0

References

CVE
CVE-2024-1273
URL
https://research.cleantalk.org/cve-2024-1273/
YouTube Video

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Submitter
Dmitrii Ignatyev
Submitter website
https://research.cleantalk.org
Verified
Yes
WPVDB ID
9784d7c8-e3aa-42af-ace8-5b2b37ebc9cb

Timeline

Publicly Published
2024-02-13 (about 2 months ago)
Added
2024-02-13 (about 2 months ago)
Last Updated
2024-02-26 (about 2 months ago)

Other

Published
Title
Published
2014-08-01
Title
JS MultiHotel 2.2.1 - includes/delete_img.php path Parameter Reflected XSS
Published
2023-06-05
Title
Aajoda Testimonials < 2.2.2 - Admin+ Stored XSS
Published
2023-05-10
Title
Brands for WooCommerce < 3.8.2 - Contributor+ Stored XSS
Published
2023-11-13
Title
Simply Excerpts <= 1.4 - Admin+ Stored XSS
Published
2014-08-01
Title
Simple Flickr Display - Username Field Stored Cross-Site Scripting (XSS)