WordPress Plugin Vulnerabilities

The Buffer Button <= 1.0 - Authenticated Stored Cross Site Scripting (XSS)

Description

The plugin was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text field.

Proof of Concept

Affects Plugins

Plugin icon
the-buffer-button
No known fix

References

CVE
CVE-2021-25058

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.8 (medium)

Miscellaneous

Original Researcher
Rutuja D Shirke
Submitter
Rutuja D Shirke
Submitter website
https://www.linkedin.com/in/rutujashirke2812/
Verified
Yes
WPVDB ID
fd5271ef-1da5-4d09-888e-f1fd71820cde

Timeline

Publicly Published
2022-01-18 (about 3 years ago)
Added
2022-01-18 (about 3 years ago)
Last Updated
2022-04-10 (about 3 years ago)

Other

Published
Title
Published
2023-08-21
Title
Min Max Control < 4.6 - Reflected XSS
Published
2022-04-26
Title
Turn off all comments <= 1.0 - Reflected Cross-Site Scripting
Published
2015-06-30
Title
NewStatPress <= 1.0.3 - Unauthenticated Stored Cross-Site Scripting (XSS)
Published
2025-02-23
Title
AR For WordPress < 7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-04-01
Title
Colibri Page Builder < 1.0.270 - Contributor+ Stored XSS