WordPress Plugin Vulnerabilities

Cost Calculator <= 1.8 - Contributor+ Stored XSS

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

[nd_cost_calculator id='" onmouseover="alert(1)" style="background:red;"']

Affects Plugins

Plugin icon
nd-projects
No known fix

References

CVE
CVE-2023-0165

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Lana Codes
Submitter
Lana Codes
Submitter website
https://lana.codes/
Submitter twitter
LanaCodes
Verified
Yes
WPVDB ID
f00b82f7-d8ad-4f6b-b791-81cc16b6336b

Timeline

Publicly Published
2023-02-13 (about 9 months ago)
Added
2023-02-13 (about 9 months ago)
Last Updated
2023-02-13 (about 9 months ago)

Other

Published
Title
Published
2023-03-28
Title
Custom Post Type and Taxonomy GUI Manager <= 1.1 - Stored XSS via CSRF
Published
2023-01-30
Title
EmbedStories < 0.7.5 - Contributor+ Stored XSS
Published
2023-02-15
Title
Zeno Font Resizer < 1.8.0 - Admin+ Stored XSS
Published
2021-10-11
Title
Print-O-Matic < 2.0.3 - Admin+ Stored Cross-Site Scripting
Published
2021-05-31
Title
WP Config File Editor <= 1.7.1 - Authenticated Stored Cross-Site Scripting (XSS)