WordPress Plugin Vulnerabilities

Responsive video embed < 0.5.1 - Contributor+ Stored XSS

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

As a contributor, create a post with the following shortcode: [rve src='" onload=alert(/XSS/) " ']

The XSS will be triggered when any user will (pre)view the post

Affects Plugins

Plugin icon
responsive-video-embed
Fixed in 0.5.1

References

CVE
CVE-2024-5475

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Original Researcher
Felipe Caon
Submitter
caon
Submitter website
https://caon.io
Verified
Yes
WPVDB ID
cee66543-b5d6-4205-8f9b-0febd7fee445

Timeline

Publicly Published
2024-05-30 (about 1 months ago)
Added
2024-05-30 (about 30 days ago)
Last Updated
2024-05-30 (about 30 days ago)

Other

Published
Title
Published
2024-05-15
Title
Royal Elementor Addons and Templates < 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder Widget
Published
2023-07-12
Title
Radio Forge Muses Player with Skins <= 2.5 - Reflected Cross-Site Scripting
Published
2016-06-27
Title
WP Security Audit Log 1.5-2.4.3 - Authenticated Reflected Cross-Site Scripting (XSS)
Published
2024-01-10
Title
Woocommerce Vietnam Checkout < 2.0.8 - Admin+ Stored Cross-Site Scripting
Published
2024-05-29
Title
Login Logout Register Menu <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'llrmloginlogout' Shortcode