Scroll To Top < 1.4.1 – Admin+ Stored Cross-Site Scripting | CVE 2022-2710 | Plugin Vulnerabilities

Description

The plugin does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

Put the following payload in the "Text" settings of the plugin and save: "autofocus onfocus=alert(/XSS/)//

The XSS will be triggered when accessing the settings again

Affects Plugins

Fixed in 1.4.1

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Asif Nawaz Minhas

Submitter

Asif Nawaz Minhas

Submitter website

https://www.hackpertise.com/

Verified

Yes

WPVDB ID

f730f584-2370-49f9-a094-a5bc521671c1

Timeline

Publicly Published

2022-08-23 (about 3 years ago)

Added

2022-08-23 (about 3 years ago)

Last Updated

2023-05-13 (about 2 years ago)

Other

Published

Title

Published

2015-08-10

Title

Email Encoder Bundle <= 1.4.1 - Unauthenticated Cross-Site Scripting (XSS)

Published

2022-03-07

Title

Plezi < 1.0.3 - Unauthenticated Stored XSS

Published

2015-04-25

Title

The7 Premium Theme < 2.1.1 - Cross-Site Scripting (XSS)

Published

2025-10-18

Title

Booster for WooCommerce < 7.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2021-12-14

Title

H5P CSS Editor <= 1.0 - Reflected Cross-Site Scripting