WordPress Plugin Vulnerabilities

Simple Posts Ticker < 1.1.6 - Contributor+ Stored XSS

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

Add a post with the shortcode: 

`[spt-posts-ticker label_text_size='" onmouseover="alert(/XSS/)"' label_text="123123"]`

View the shortcode and move your mouse over the string `123123` to see the XSS.

Affects Plugins

Plugin icon
simple-posts-ticker
Fixed in 1.1.6

References

CVE
CVE-2023-4646

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Submitter
Dmitrii Ignatyev
Submitter website
https://blog.cleantalk.org
Verified
Yes
WPVDB ID
c34f8dcc-3be6-44ad-91a4-7c3a0ce2f9d7

Timeline

Publicly Published
2023-09-25 (about 2 months ago)
Added
2023-09-25 (about 2 months ago)
Last Updated
2023-09-25 (about 2 months ago)

Other

Published
Title
Published
2014-09-27
Title
bSuite - Multiple Cross-Site Scripting (XSS)
Published
2023-06-22
Title
Mail Queue < 1.2 - Unauthenticated Stored Cross-Site Scripting
Published
2023-03-20
Title
TreePress – Easy Family Trees & Ancestor Profiles < 3.0.0 - Admin+ Stored Cross-Site Scripting
Published
2023-03-03
Title
Watu Quiz < 3.3.9.1 - Reflected XSS
Published
2023-06-19
Title
Float menu < 5.0.3 - Admin+ Stored Cross-Site Scripting