Newsletter < 7.4.6 – Admin+ Stored Cross-Site Scripting | CVE 2022-1889 | Plugin Vulnerabilities

Description

The plugin does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfilteredhtml is disallowed

Proof of Concept

Go to Newsletters of Newsletter at wordpress admin panel ( eg . https://wordpress.local/wp-admin/admin.php?page=newsletter_emails_index ).
Create the "new newsletter", and then choose any type of templates ( default presets ) except from Raw HTML. 
Input the simple test XSS payload at the Snippet Input
Payload : Test Snippet<script>alert(0)</script>

And Click the "Save" and "Next". The Stored XSS payload will execute.

Affects Plugins

Fixed in 7.4.6

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

PHYO WIN SHEIN

Submitter

PHYO WIN SHEIN

Submitter twitter

Verified

Yes

WPVDB ID

ee3832e2-ce40-4063-a23e-44c7f7f5f46a

Timeline

Publicly Published

2022-05-30 (about 3 years ago)

Added

2022-05-30 (about 3 years ago)

Last Updated

2023-02-25 (about 2 years ago)

Other

Published

Title

Published

2024-07-11

Title

EazyDocs < 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2022-09-12

Title

DSGVO All in one for WP < 4.2 - Admin+ Stored Cross-Site Scripting

Published

2024-08-28

Title

The Plus Addons for Elementor Page Builder Lite < 5.6.3 - Authenticated (Author+) Stored Cross-Site Scripting

Published

2024-03-27

Title

Events Manager < 6.4.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2021-06-28

Title

Tutor LMS < 1.9.2 - Authenticated Stored Cross-Site Scripting (XSS)