Logo Slider < 4.6.0 – Contributor+ Stored XSS | CVE 2024-12308 | Plugin Vulnerabilities

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

1) Create a new Logo Slider shortcode with test name.
2) Intercept update request and change "5Blgx_carousel_transition_speed" field to `123" onmouseover=alert(1)//`
3) Put shortcode inside a new post. Hover over carousel to trigger XSS

Affects Plugins

Fixed in 4.6.0

References

CVE

URL

https://research.cleantalk.org/cve-2024-12308/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://www.linkedin.com/in/dmitriy-ignatyev-8a9189267/

Verified

Yes

WPVDB ID

fa82ada7-357b-4f01-a0d6-ff633b188a80

Timeline

Publicly Published

2025-02-03 (about 11 months ago)

Added

2025-02-03 (about 11 months ago)

Last Updated

2025-02-03 (about 11 months ago)

Other

Published

Title

Published

2022-08-22

Title

WBW Currency Switcher for WooCommerce < 1.6.6 - Admin+ Stored XSS

Published

2024-12-13

Title

Visualmodo Elements <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

Published

2019-05-27

Title

Event Management Tickets Booking By Event Monster <= 1.0.5 - Stored XSS

Published

2023-11-07

Title

CodeBard's Patron Button and Widgets for Patreon < 2.2.0 - Reflected XSS

Published

2014-07-16

Title

Profile Builder < 1.1.66 - Multiple XSS