ActivityPub for WordPress < 1.0.1 – Contributor+ Stored XSS | CVE 2023-3746 | Plugin Vulnerabilities

Description

The plugin does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks

Proof of Concept

As a contributor, create or edit a post with the payload below while in code editor mode

<img src="404" id="!#!#PROTECT0#!#!"/><pre class=" onerror=alert(document.domain) ">xyz</pre>

The XSS will be triggered when viewing/previewing the post

Affects Plugins

Fixed in 1.0.1

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Ben Bidner

Verified

Yes

WPVDB ID

c15a6032-6495-47a8-828c-37e55ed9665a

Timeline

Publicly Published

2023-09-25 (about 2 years ago)

Added

2023-09-25 (about 2 years ago)

Last Updated

2023-09-25 (about 2 years ago)

Other

Published

Title

Published

2025-04-24

Title

Ajax Comment Form CST <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published

2025-04-23

Title

Advanced Accordion Gutenberg Block < 5.0.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

Published

2020-07-24

Title

JobSearch < 1.5.6 - Unauthenticated Reflected XSS

Published

2024-02-12

Title

TNC PDF viewer < 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

Published

2025-01-14

Title

Tag Groups is the Advanced Way to Display Your Taxonomy Terms < 2.0.5 - Reflected Cross-Site Scripting