Responsive Tabs < 4.0.7 – Contributor+ Stored XSS | CVE 2024-1846 | Plugin Vulnerabilities

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Proof of Concept

1. Go to "Tab Sets > Add New" in WP Admin
2. Add a new tab and fill out values.
3. Intercept the request and for the `tabs_color` parameter, add the payload `"+onmouseover='alert(1)'"`
4. Send the request and then preview the tab group to see the XSS

Affects Plugins

responsive-tabs

Fixed in 4.0.7

References

CVE

URL

https://research.cleantalk.org/cve-2024-1846/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://research.cleantalk.org

Verified

Yes

WPVDB ID

ea2a8420-4b0e-4efb-a0c6-ceea996dae5a

Timeline

Publicly Published

2024-03-25 (about 1 year ago)

Added

2024-03-25 (about 1 year ago)

Last Updated

2024-04-08 (about 1 year ago)

Other

Published

Title

Published

2025-09-23

Title

Themify Builder < 7.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2014-08-01

Title

WP Microblogs plugin < 0.4.0 - Cross-Site Scripting (XSS)

Published

2017-07-25

Title

Weblibrarian < 3.4.8.7 - XSS

Published

2025-09-26

Title

The Tribal < 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2025-01-16

Title

Sandbox <= 0.4 - Reflected Cross-Site Scripting