WP Duplicate Page < 1.3 – Admin+ Stored Cross Site Scripting | CVE 2022-2093 | Plugin Vulnerabilities

Description

The plugin does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.

Proof of Concept

1. Navigate to Settings ->Duplicate Page -> Duplicate Page Settings and enter the XSS payload into
the Duplicate Page Link Text input field.
2. Click Save Changes.
3. You will observe that the payload successfully got stored into the
database and when you are triggering the same functionality at that time
JavaScript payload is executing successfully and we are getting a pop-up.
4. Payload Used: "onmouseover=alert(/XSS/)//

Affects Plugins

wp-duplicate-page

Fixed in 1.3

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Sachin Bahl from eSec Forte Technologies Pvt Ltd

Submitter

Sachin Bahl from eSec Forte Technologies Pvt Ltd

Submitter website

https://www.linkedin.com/in/sachin-bahl-6072084/

Verified

Yes

WPVDB ID

a11628e4-f47b-42d8-9c09-7536d49fce4c

Timeline

Publicly Published

2022-06-20 (about 3 years ago)

Added

2022-06-20 (about 3 years ago)

Last Updated

2023-03-24 (about 2 years ago)

Other

Published

Title

Published

2025-05-07

Title

DoFollow Case by Case <= 3.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2024-10-31

Title

Sided <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-01-12

Title

Ultimate Maps by Supsystic < 1.2.16 - Admin+ Stored XSS

Published

2024-10-31

Title

LH QR Codes <= 1.06 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-05-07

Title

JupiterX Core < 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting