Browser Screenshots < 1.7.6 – Contributor+ Stored XSS | CVE 2021-24439 | Plugin Vulnerabilities

Description

The plugin allowed authenticated users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks as the image_class parameter of the browser-shot shortcode was not escaped.

Proof of Concept

Add the following shortcode in a page, then view the page (either published or as preview to trigger the XSS): [browser-shot url="https://example.com" image_class='" onload="alert(origin)']

Affects Plugins

Fixed in 1.7.6

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

apple502j

Submitter

apple502j

Verified

Yes

WPVDB ID

9c538c51-ae58-461d-b93b-cc9dfebf2bc0

Timeline

Publicly Published

2021-06-21 (about 4 years ago)

Added

2021-06-21 (about 4 years ago)

Last Updated

2021-06-25 (about 4 years ago)

Other

Published

Title

Published

2020-01-16

Title

Resim Ara <= 3.0 - Unauthenticated Reflected XSS

Published

2024-10-14

Title

Mitm Bug Tracker <= 1.0 - Reflected Cross-Site Scripting

Published

2022-05-17

Title

WP Athletics <= 1.1.7 - Subscriber+ Stored Cross-Site Scripting

Published

2025-01-06

Title

WP Youtube Gallery < 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

Published

2024-05-30

Title

YITH WooCommerce Wishlist < 3.33.0 - Authenticated (Admin+) Stored Cross-Site Scripting