GetYourGuide Ticketing < 1.0.4 – Admin+ Stored XSS | CVE 2022-3609 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

1. Navigate toward the GYG Ticketing and GYG Ticketing > Link builder.
2. Enter the XSS payload: " style=animation-name:rotation onanimationstart=alert(/XSS/)//
3. Go to Link builder and click on Generate links to trigger the XSS

Affects Plugins

getyourguide-ticketing

Fixed in 1.0.4

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Mariam Tariq - HunterSherlock

Submitter

Mariam Tariq - HunterSherlock

Verified

Yes

WPVDB ID

b893cac2-6511-4e2a-9eff-baf0f3cc9d7e

Timeline

Publicly Published

2022-11-17 (about 3 years ago)

Added

2022-11-16 (about 3 years ago)

Last Updated

2022-11-29 (about 3 years ago)

Other

Published

Title

Published

2024-04-25

Title

Recencio Book Reviews <= 1.66.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-04-02

Title

Gutenberg Blocks by Kadence Blocks < 3.2.18 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings

Published

2015-06-14

Title

Content Grabber 1.0 - Cross-Site Scripting (XSS)

Published

2017-03-10

Title

WP Markdown Editor 2.3.0 - Authenticated "Self" Cross-Site Scripting (XSS)

Published

2023-04-19

Title

Ebook Store < 5.78 - Admin+ Stored XSS