WordPress Plugin Vulnerabilities

WP Table Reloaded <= 1.9.4 - Contributor+ Stored XSS

Description

The plugin does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admins.

Proof of Concept

Exploit shortcode:

[table id='1' border='1" onmouseover="alert(1)']

Affects Plugins

Plugin icon
wp-table-reloaded
No known fix

References

CVE
CVE-2022-4491

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Lana Codes
Submitter
Lana Codes
Submitter website
https://lana.codes/
Submitter twitter
LanaCodes
Verified
Yes
WPVDB ID
b62d8fa6-d546-4794-8f7a-c5e4a7f607dc

Timeline

Publicly Published
2022-12-14 (about 1 years ago)
Added
2022-12-14 (about 1 years ago)
Last Updated
2022-12-14 (about 1 years ago)

Other

Published
Title
Published
2022-06-14
Title
WooCommerce PDF Invoices & Packing Slips < 2.15.0 - Reflected Cross-Site Scripting
Published
2017-08-21
Title
Liveforms < 3.4.0 - XSS
Published
2024-03-15
Title
ElementsKit Elementor addons < 3.0.4 - Contributor+ Stored XSS
Published
2022-08-10
Title
Best Payments Plugin for WP < 4.2.1 - Reflected Cross-Site Scripting
Published
2016-07-19
Title
Ninja Forms <= 2.9.51 - Multiple Authenticated Cross-Site Scripting (XSS)