WordPress Plugin Vulnerabilities

Product Slider for WooCommerce < 2.6.4 - Contributor+ Stored XSS in Shortcode

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Proof of Concept

Install the Dependency plugin - WooCommerce: https://wordpress.org/plugins/woocommerce

Exploit shortcode:

[woo-product-slider id='" onmouseover="alert(1)" style="background:red;"']

Affects Plugins

Plugin icon
woo-product-slider
Fixed in 2.6.4

References

CVE
CVE-2022-4629

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Lana Codes
Submitter
Lana Codes
Submitter website
https://lana.codes/
Submitter twitter
LanaCodes
Verified
Yes
WPVDB ID
cf0a51f9-21d3-4ae8-b7d2-361921038fe8

Timeline

Publicly Published
2022-12-28 (about 1 years ago)
Added
2022-12-28 (about 1 years ago)
Last Updated
2022-12-28 (about 1 years ago)

Other

Published
Title
Published
2014-08-01
Title
Audio Player - player.swf playerID Parameter XSS
Published
2024-05-03
Title
PropertyHive < 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-01-18
Title
Better Font Awesome < 2.0.4 - Contributor+ Stored XSS
Published
2023-09-11
Title
Booking Calendar < 9.7.3.1 - Unauthenticated Stored XSS
Published
2022-12-23
Title
RSSImport <= 4.6.1 - Contributor+ Stored XSS via Shortcode