WordPress Plugin Vulnerabilities

Image Hover Effects < 5.5 - Admin+ Stored XSS

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Proof of Concept

Go to the plugin settings (Image Hover Effects > Image Hover Effects) and put the following payload in any input field (such as Category Name, Caption Description, Caption Heading, etc.) and save: "><img src=x onerror=alert(/XSS/)>

The XSS will be triggered when accessing the settings again, as well as in posts/pages where the caption is embedded via shortcode.

Affects Plugins

Plugin icon
image-hover-effects
Fixed in 5.5

References

CVE
CVE-2022-4010

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.4 (low)

Miscellaneous

Original Researcher
Asif Nawaz Minhas
Submitter
Asif Nawaz Minhas
Submitter website
https://www.hackpertise.com/
Verified
Yes
WPVDB ID
bed8c81c-04c7-412d-9563-ce4eb64b7754

Timeline

Publicly Published
2022-11-16 (about 1 years ago)
Added
2022-11-16 (about 1 years ago)
Last Updated
2023-02-20 (about 1 years ago)

Other

Published
Title
Published
2023-10-26
Title
Animated Counters < 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2022-05-26
Title
Custom Share Buttons with Floating Sidebar < 4.2 - Admin+ Stored XSS
Published
2019-05-14
Title
Register IPs <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting (XSS)
Published
2023-02-02
Title
Image Hover Effects for Elementor with Lightbox and Flipbox < 3.0 - Reflected XSS
Published
2023-04-14
Title
AdFoxly <= 1.8.5 - Reflected XSS