YARPP – Yet Another Related Posts Plugin < 5.30.3 – Contributor+ Stored XSS | CVE 2022-4471

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Proof of Concept

v < 5.30.3
[yarpp template="' onmouseover='alert(/XSS/)"]

v < 5.30.2
[yarpp extra_css_class="' onmouseover='alert(/XSS/)"]

Affects Plugins

yet-another-related-posts-plugin

Fixed in 5.30.3

References

CVE

CVE-2022-4471

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

6.8 (medium)

Miscellaneous

Original Researcher

Lana Codes

Submitter

Lana Codes

Submitter website

https://lana.codes/

Submitter twitter

LanaCodes

Verified

Yes

WPVDB ID

c6cf792b-054c-4d77-bcae-3b700f42130b

Timeline

Publicly Published

2023-01-19 (about 1 years ago)

Added

2023-01-19 (about 1 years ago)

Last Updated

2023-04-28 (about 1 years ago)

Other

Published

Title

Published

2023-10-23

Title

WDContactFormBuilder <= 1.0.72 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published

2024-02-29

Title

Exclusive Addons for Elementor < 2.6.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget

Published

2015-08-14

Title

WP-Polls <= 2.70 - Stored Cross-Site Scripting (XSS)

Published

2023-03-17

Title

Article Directory <= 1.3 - Admin+ Stored XSS

Published

2023-01-17

Title

WP Visitor Statistics (Real Time Traffic) < 6.5 - Contributor+ Stored XSS via Shortcode