WordPress Plugin Vulnerabilities

BU Section Editing <= 0.9.9 - Reflected XSS

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Proof of Concept

Affects Plugins

Plugin icon
bu-section-editing
No known fix

References

CVE
CVE-2024-12736

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Hassan Khan Yusufzai - Splint3r7
Submitter
Hassan Khan Yusufzai - Splint3r7
Submitter website
https://hassankhanyusufzai.com
Submitter twitter
Splint3r7
Verified
Yes
WPVDB ID
d3c6a4c1-8358-4f8b-b58d-3f712052668f

Timeline

Publicly Published
2024-12-19 (about 1 year ago)
Added
2024-12-19 (about 1 year ago)
Last Updated
2024-12-19 (about 1 year ago)

Other

Published
Title
Published
2025-06-27
Title
WP Edit <= 4.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-11-08
Title
Mage Front End Forms <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-01-16
Title
Admin Menu Organizer <= 1.0.1 - Reflected Cross-Site Scripting
Published
2025-02-22
Title
Fast Flow < 1.2.18 - Reflected Cross-Site Scripting
Published
2024-05-09
Title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders < 5.9.20 - Contributor+ Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table'