WordPress Plugin Vulnerabilities

ShareThis Dashboard for Google Analytics < 2.5.2 - Reflected Cross-Site Scripting (XSS)

Description

The plugin does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator

Proof of Concept

Plugin needs to be connected to Google Analytics account.

https://example.com/wp-admin/admin.php?page=googleanalytics&ga_action=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E

Affects Plugins

Plugin icon
googleanalytics
Fixed in 2.5.2

References

CVE
CVE-2021-24438

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
renniepak
Submitter
renniepak
Submitter twitter
renniepak
Verified
Yes
WPVDB ID
af472879-9328-45c2-957f-e7bed77e4c2d

Timeline

Publicly Published
2021-08-02 (about 2 years ago)
Added
2021-08-02 (about 2 years ago)
Last Updated
2022-02-24 (about 1 years ago)

Other

Published
Title
Published
2023-10-02
Title
Email posts to subscribers <= 6.2 - Admin+ Stored XSS
Published
2023-04-24
Title
Advanced Youtube Channel Pagination <= 1.0 - Reflected XSS
Published
2014-10-30
Title
Profile Builder < 2.0.3 - Reflected Cross-Site Scripting (XSS)
Published
2023-05-04
Title
Cart Lift < 3.1.6 - Reflected XSS
Published
2022-09-12
Title
DSGVO All in one for WP < 4.2 - Admin+ Stored Cross-Site Scripting