WP User Profile Avatar < 1.0.2 – Contributor+ Stored XSS | CVE 2023-6067

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Proof of Concept

Enter the following shortcode in a post, and hover the resulting HTML.

[user_profile_avatar size='" onmouseover="alert(/XSS/)"']

Affects Plugins

wp-user-profile-avatar

Fixed in 1.0.2

References

CVE

CVE-2023-6067

URL

https://research.cleantalk.org/cve-2023-6067/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

5.9 (medium)

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://research.cleantalk.org

Verified

Yes

WPVDB ID

ae8e225a-5273-4db1-9c72-060304cca658

Timeline

Publicly Published

2024-03-25 (about 1 year ago)

Added

2024-03-25 (about 1 year ago)

Last Updated

2025-01-09 (about 11 months ago)

Other

Published

Title

Published

2023-10-24

Title

WP GoToWebinar < 14.46 - Admin+ Stored XSS

Published

2025-01-06

Title

Widgetize Pages Light <= 3.0 - Reflected Cross-Site Scripting

Published

2025-02-03

Title

Music Press Pro <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-01-16

Title

Userbase Access Control <= 1.0 - Reflected Cross-Site Scripting

Published

2025-03-27

Title

Ultimate Dashboard < 3.8.6 - Admin+ Stored XSS