WordPress Plugin Vulnerabilities

Splash Header < 1.20.8 - Authenticated Stored Cross-Site Scripting (XSS)

Description

The plugin doesn't sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue.

Proof of Concept

Put the following payload in the "Note title" and "Note message" settings of the plugin: "><script>alert(/XSS-Title/)</script> and </textarea><script>alert(/XSS-Msg/)</script>

Then visit the Admin Dashboard homepage or the plugin's settings (/wp-admin/admin.php?page=Splash_Header_Display&tab=homepage)  to trigger the XSS

https://github.com/xiahao90/CVEproject/blob/main/wordpress_Splashheader_XSS.md

Affects Plugins

Plugin icon
splash-header
Fixed in 1.20.8

References

CVE
CVE-2021-24587

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
xiahao
Submitter
xiahao
Submitter twitter
lAmn9V6MU9Dfb8p
Verified
Yes
WPVDB ID
bb5d94ad-e1ce-44e2-8403-d73fe75a146a

Timeline

Publicly Published
2021-07-29 (about 2 years ago)
Added
2021-08-19 (about 2 years ago)
Last Updated
2022-04-09 (about 1 years ago)

Other

Published
Title
Published
2021-11-15
Title
Pixel Cat Lite < 2.6.3 - Admin+ Stored Cross-Site Scripting
Published
2023-02-15
Title
vSlider Multi Image Slider for WordPress <= 4.1.2 - Contributor+ Stored XSS
Published
2012-07-23
Title
Get Off Malicious Scripts - Cross-Site Scripting (XSS)
Published
2023-03-13
Title
Site Reviews < 6.6.0 - Contributor+ Stored XSS
Published
2022-12-19
Title
Jetpack CRM < 5.5 - Contributor+ Stored XSS