WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS)

vendor:

WordPress Plugin Security Audit

by:

Shweta Mahajan

4.8

CVSS

MEDIUM

Stored Cross Site Scripting (XSS)

CWE

Product Name: WordPress Plugin Security Audit

Affected Version From: 1.0.0

Affected Version To: 1.0.0

Patch Exists: YES

Related CWE: CVE-2021-24901

CPE: 2.3:a:wordpress:wordpress_plugin_security_audit:1.0.0

Metasploit:

Other Scripts:

Platforms Tested: Windows

2022

WordPress Plugin Security Audit 1.0.0 – Stored Cross Site Scripting (XSS)

A stored cross-site scripting (XSS) vulnerability was discovered in the WordPress Plugin Security Audit version 1.0.0. An attacker can inject malicious JavaScript payloads into the 'Data Id' field of the Security Audit settings, which will be stored in the database. When the same functionality is triggered, the malicious payload will be executed, allowing the attacker to perform malicious activities such as stealing user data or executing arbitrary code.

Mitigation:

Users should update to the latest version of the WordPress Plugin Security Audit, which is 1.0.1, to mitigate this vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS)
# Date: 2022-01-26
# Exploit Author: Shweta Mahajan
# Vendor Homepage: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/
# Software Link: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/
# Tested on Windows
# CVE: CVE-2021-24901
# Reference: 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24901
https://wpscan.com/vulnerability/9c315404-b66a-448c-a3b7-367a37b53435

How to reproduce vulnerability:

1. Install Latest WordPress

2. Install and activate Titan-labs-security-audit Version 1.0.0

3. Navigate to Security Audit settings >> enter the payload into 'Data Id'.

4. Enter JavaScript payload which is mentioned below
    "><img src=x onerror=confirm(1)>

5. You will observe that the payload successfully got stored into the
    database and when you are triggering the same functionality at that
    time JavaScript payload gets executed successfully and we'll get a
    pop-up.