WordPress Plugin Vulnerabilities
Rough Chart <= 1.0.0 - Admin+ Stored Cross-Site Scripting
Description
The plugin does not properly escape chart data label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Proof of Concept
Create a chart (/wp-admin/themes.php?page=rough_chart), add the following payload in a Chart Data Label and save it: <a href="javascript:alert(/XSS/)">XSS</a> The XSS will be triggered when viewing the chart and clicking on the label
Affects Plugins
No known fix - plugin closed
References
Classification
Miscellaneous
Original Researcher
Siddhant Suresh Ughade
Submitter
Siddhant Suresh Ughade
Submitter website
Verified
Yes
Timeline
Publicly Published
2022-07-18 (about 6 months ago)
Added
2022-07-18 (about 6 months ago)
Last Updated
2022-07-18 (about 6 months ago)