Floating Contact Button < 2.8 – Admin+ Stored XSS | CVE 2024-7891 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Proof of Concept

1. Navigate to the “Floating Contact” section of WP Admin
2. Locate the “Insert here your shortcode” field.
3. Enter the following payload: ` "><img src=x onerror=alert(document.domain)>`
4. Check the button next to "jQuery" 
5. Click on "Save Settings" to apply the changes.
6. Confirm that the XSS is triggered by observing an alert on the homepage screen.

Affects Plugins

floating-contact

Fixed in 2.8

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Submitter

Kientt

Verified

Yes

WPVDB ID

b584a225-0d91-464d-b1c1-15594274d9d4

Timeline

Publicly Published

2024-08-20 (about 1 year ago)

Added

2024-08-20 (about 1 year ago)

Last Updated

2024-08-20 (about 1 year ago)

Other

Published

Title

Published

2024-02-12

Title

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders < 5.9.9 - Contributor+ Stored Cross-Site Scripting via Accordion

Published

2018-02-20

Title

Ninja Forms <= 3.2.13 - Cross-Site Scripting (XSS)

Published

2023-10-13

Title

LeadSquared Suite <= 0.7.4 - Admin+ Stored XSS

Published

2024-01-16

Title

Stock Locations for WooCommerce < 2.6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Published

2024-05-07

Title

All-in-One Addons for Elementor – WidgetKit < 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting