WordPress Plugin Vulnerabilities

Splash Header < 1.20.8 - Authenticated Stored Cross-Site Scripting (XSS)

Description

The plugin doesn't sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue.

Proof of Concept

Put the following payload in the "Note title" and "Note message" settings of the plugin: "><script>alert(/XSS-Title/)</script> and </textarea><script>alert(/XSS-Msg/)</script>

Then visit the Admin Dashboard homepage or the plugin's settings (/wp-admin/admin.php?page=Splash_Header_Display&tab=homepage)  to trigger the XSS

https://github.com/xiahao90/CVEproject/blob/main/wordpress_Splashheader_XSS.md

Affects Plugins

Plugin icon
splash-header
Fixed in 1.20.8

References

CVE
CVE-2021-24587

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
xiahao
Submitter
xiahao
Submitter twitter
lAmn9V6MU9Dfb8p
Verified
Yes
WPVDB ID
bb5d94ad-e1ce-44e2-8403-d73fe75a146a

Timeline

Publicly Published
2021-07-29 (about 2 years ago)
Added
2021-08-19 (about 2 years ago)
Last Updated
2022-04-09 (about 2 years ago)

Other

Published
Title
Published
2024-04-15
Title
WP Dynamic Keywords Injector < 2.3.22 - Reflected Cross-Site Scripting
Published
2023-11-10
Title
POWR < 2.2.0 - Contributor+ Stored XSS
Published
2021-09-27
Title
WP Visited Countries Reloaded < 3.1.1 - Reflected Cross-Site Scripting
Published
2024-04-03
Title
Floating Chat Widget < 3.1.9 - Editor+ Stored XSS
Published
2024-04-10
Title
F4 Improvements < 1.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting