Advanced Page Visit Counter 1.0 - Admin+ Stored Cross-Site Scripting (XSS) (Authenticated)

vendor:

Advanced Page Visit Counter

by:

Furkan ÖZER

6.1

CVSS

HIGH

Stored Cross-Site Scripting (XSS)

CWE

Product Name: Advanced Page Visit Counter

Affected Version From: 1

Affected Version To: 8.0.5

Patch Exists: NO

Related CWE:

CPE: a:wordpress:advanced_page_visit_counter:8.0.5

Metasploit:

Other Scripts:

Platforms Tested: Kali-Linux, Windows 10, Windows 11

2023

Advanced Page Visit Counter 1.0 – Admin+ Stored Cross-Site Scripting (XSS) (Authenticated)

The Advanced Page Visit Counter plugin for WordPress version 8.0.5 is vulnerable to Stored Cross-Site Scripting (XSS) attacks. A high privilege user such as an admin can execute malicious scripts in the plugin's settings, even if the unfiltered_html capability is restricted.

Mitigation:

To mitigate this vulnerability, it is recommended to update the plugin to the latest version as soon as a patch is released. Additionally, users should avoid inputting untrusted data into the plugin's settings.

Source

Exploit-DB raw data:

# Exploit Title: Advanced Page Visit Counter 1.0 - Admin+ Stored Cross-Site
Scripting (XSS) (Authenticated)
# Date: 11.10.2023
# Exploit Author: Furkan ÖZER
# Software Link: https://wordpress.org/plugins/advanced-page-visit-counter/
# Version: 8.0.5
# Tested on: Kali-Linux,Windows10,Windows 11
# CVE: N/A


# Description:
Advanced Page Visit Counter is a remarkable Google Analytics alternative
specifically designed for WordPress websites, and it has quickly become a
must-have plugin for website owners and administrators seeking powerful
tracking and analytical capabilities. With the recent addition of Enhanced
eCommerce Tracking for WooCommerce, this plugin has become even more
indispensable for online store owners.

Homepage | Support | Premium Version

If you’re in search of a GDPR-friendly website analytics plugin exclusively
designed for WordPress, look no further than Advanced Page Visit Counter.
This exceptional plugin offers a compelling alternative to Google Analytics
and is definitely worth a try for those seeking enhanced data privacy
compliance.

This is a free plugin and doesn’t require you to create an account on
another site. All features outlined below are included in the free plugin.

Description of the owner of the plugin Stored Cross-Site Scripting attack
against the administrators or the other authenticated users.

The plugin does not sanitise and escape some of its settings, which could
allow high privilege users such as admin to perform Stored Cross-Site
Scripting attacks even when the unfiltered_html capability is disallowed
(for example in multisite setup)

The details of the discovery are given below.

# Steps To Reproduce:
1. Install and activate the Advanced Page Visit Counter plugin.
2. Visit the "Settings" interface available in settings page of the plugin
that is named "Widget Settings"
3. In the plugin's "Today's Count Label" setting field, enter the payload
Payload: " "type=image src=1 onerror=alert(document.cookie)> "
6. Click the "Save Changes" button.
7. The XSS will be triggered on the settings page when every visit of an
authenticated user.


# Video Link
https://youtu.be/zcfciGZLriM