404s < 3.5.1 – Admin+ Stored Cross-Site Scripting | CVE 2022-2118 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape its fields, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Proof of Concept

Create/edit a new 404 via the plugin and put the following payload in the "Please enter the 404 URL in here:" field:

v < 3.4.9 - "><svg onload=alert(/XSS/)> 
v < 3.5.1 - " style=animation-name:rotation onanimationstart=alert(/XSS/)//

Affects Plugins

Fixed in 3.5.1

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Vivek Kumar Jaiswal

Submitter

Vivek Kumar Jaiswal

Submitter website

https://www.linkedin.com/in/vivek-kumar-jaiswal-890888179/

Verified

Yes

WPVDB ID

9a19af60-d6e6-4fa3-82eb-3636599b814c

Timeline

Publicly Published

2022-06-22 (about 3 years ago)

Added

2022-06-22 (about 3 years ago)

Last Updated

2023-03-29 (about 2 years ago)

Other

Published

Title

Published

2023-11-08

Title

IdeaPush < 8.53 - Admin+ Stored XSS

Published

2022-11-14

Title

WP Affiliate Platform < 6.4.0 - Admin+ Stored XSS

Published

2023-06-15

Title

WP Matterport Shortcode < 2.1.5 - Contributor+ Stored XSS

Published

2024-05-27

Title

FV Flowplayer Video Player < 7.5.46.7212 - Reflected Cross-Site Scripting

Published

2025-01-30

Title

Storely <= 20.7 - Authenticated (Contributor+) Stored Cross-Site Scripting