FS Product Inquiry <= 1.1.1 – Unauthenticated Stored XSS | CVE 2024-4857 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some form submissions, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks

Proof of Concept

1. Add an inquiry form using the shortcode `[fspi-show-products-list]`
2. As a non-logged in visitor, enter the payload `
" style=animation-name:rotation onanimationstart=alert(/XSS/)//` for the name
3. See the XSS when editing an individual inquiry from: https://example.com/wp-admin/edit.php?post_type=fspi-inquiry

Affects Plugins

fs-product-inquiry

No known fix

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Bob Matyas

Submitter

Bob Matyas

Submitter website

https://www.bobmatyas.com

Submitter twitter

Verified

Yes

WPVDB ID

bf1b8434-b361-4666-9058-d9f08c09d083

Timeline

Publicly Published

2024-05-14 (about 1 year ago)

Added

2024-05-14 (about 1 year ago)

Last Updated

2024-05-14 (about 1 year ago)

Other

Published

Title

Published

2024-06-13

Title

WP Go Maps (formerly WP Google Maps) < 9.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2019-02-05

Title

YOP Poll <= 6.0.2 - Cross-Site Scripting (XSS)

Published

2014-08-01

Title

background-music 1.0 - jPlayer.swf XSS

Published

2024-04-29

Title

Elementor ImageBox <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-04-10

Title

Cart66 Cloud <= 2.3.7 - Reflected Cross-Site Scripting