WordPress Plugin Vulnerabilities

Fancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting via Product Title

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

Note: This requires WooCommerce to be installed.

1. As an admin, navigate to: https://example.com/wp-admin/admin.php?page=fancy_product_designer
2. Add or modify a product title to contain the payload: `" style=animation-name:rotation onanimationstart=alert(/XSS-Product-TitleModified/)//`
3. Save the results.
4. Edit/create a product in the editor via `Products > All Products`
5. You will see the XSS pop-up.

Affects Plugins

Plugin icon
fancy-product-designer
Fixed in 6.1.81

References

CVE
CVE-2024-0902

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Original Researcher
Bob Matyas
Submitter
Bob Matyas
Submitter website
https://www.bobmatyas.com
Submitter twitter
bobmatyas
Verified
Yes
WPVDB ID
fd53e40a-516b-47b9-b495-321774432367

Timeline

Publicly Published
2024-03-25 (about 1 months ago)
Added
2024-03-25 (about 1 months ago)
Last Updated
2024-03-25 (about 1 months ago)

Other

Published
Title
Published
2018-07-28
Title
Woocommerce Jetpack < 3.8.0 - XSS
Published
2022-02-07
Title
Multisite User Sync/Unsync < 2.1.2 - Reflected Cross-Site Scripting
Published
2024-03-12
Title
Burst Statistics < 1.5.7 - Contributor+ Stored Cross-Site Scripting via burst_total_pageviews_count
Published
2022-11-14
Title
WP Affiliate Platform < 6.4.0 - Reflected Cross-Site Scripting
Published
2023-01-12
Title
Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) < 3.12.7 - Contributor+ Stored XSS via Shortcode