WordPress Plugin Vulnerabilities
Amr Shortcode Any Widget <= 4.0 - Contributor+ Stored XSS
Description
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Proof of Concept
1. Insert a widget on the sidebar using the Text Block. 2. Get the widget ID by inspecting it using the browser developer tool. 3. Insert the following shortcode (change the ID accordingly): [do_widget id="block-9" class='" onmouseover="alert(1)"'] 4. Go to the page where the widget is inserted and hover it, the alert triggers.
Affects Plugins
No known fix - plugin closed
References
Classification
Miscellaneous
Original Researcher
Lana Codes
Submitter
Lana Codes
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2023-01-19 (about 4 months ago)
Added
2023-01-19 (about 4 months ago)
Last Updated
2023-01-19 (about 4 months ago)