Splash Header < 1.20.8 – Authenticated Stored Cross-Site Scripting (XSS) | CVE 2021-24587 | Plugin Vulnerabilities

Description

The plugin doesn't sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue.

Proof of Concept

Put the following payload in the "Note title" and "Note message" settings of the plugin: "><script>alert(/XSS-Title/)</script> and </textarea><script>alert(/XSS-Msg/)</script>

Then visit the Admin Dashboard homepage or the plugin's settings (/wp-admin/admin.php?page=Splash_Header_Display&tab=homepage)  to trigger the XSS

https://github.com/xiahao90/CVEproject/blob/main/wordpress_Splashheader_XSS.md

Affects Plugins

Fixed in 1.20.8

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

xiahao

Submitter

xiahao

Submitter twitter

lAmn9V6MU9Dfb8p

Verified

Yes

WPVDB ID

bb5d94ad-e1ce-44e2-8403-d73fe75a146a

Timeline

Publicly Published

2021-07-29 (about 4 years ago)

Added

2021-08-19 (about 4 years ago)

Last Updated

2022-04-09 (about 3 years ago)

Other

Published

Title

Published

2024-04-30

Title

Jeg Elementor Kit < 2.6.5 - Contributor+ Stored XSS via Elementor Widget URL Custom Attributes

Published

2025-03-31

Title

Flag Icons <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2024-11-08

Title

Ekiline Block Collection < 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-05-07

Title

WP DPE-GES < 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-01-30

Title

Table Editor < 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting