Enhanced Text Widget < 1.6.6 – Admin+ Stored XSS | CVE 2024-0559 | Plugin Vulnerabilities

Description

The plugin does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

As admin, create/edit an Enhanced Text widget and put the following payload in the Title, URL or "CSS Classes" fields: " onmouseover="alert(/XSS/)"

The XSS will be triggered when a user move their mouse over
- the title of the widget on page where the widget is output
- the related field when editing the widget

Other payload, for the URL field to trigger in the frontend: ' onmouseover=alert(/XSS-URL/)// and javascript:alert(/XSS/)

Affects Plugins

enhanced-text-widget

Fixed in 1.6.6

References

CVE

URL

https://research.cleantalk.org/cve-2024-0559/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://research.cleantalk.org

Verified

Yes

WPVDB ID

b257daf2-9540-4a0f-a560-54b47d2b913f

Timeline

Publicly Published

2024-02-13 (about 1 year ago)

Added

2024-02-13 (about 1 year ago)

Last Updated

2024-02-21 (about 1 year ago)

Other

Published

Title

Published

2025-01-10

Title

Fantastic Elasticsearch <= 4.1.0 - Reflected XSS

Published

2014-08-01

Title

placester <= 0.3.12 - XSS in ZeroClipboard

Published

2022-10-10

Title

Official Integration for Billingo < 3.4.0 - ShopManager+ Stored XSS

Published

2025-07-17

Title

Knowledge Base < 2.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Slug

Published

2025-11-20

Title

AudioTube <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting