WordPress Plugin Tagregator 0.6 - Cross-Site Scripting

vendor:

Tagregator

by:

ManhNho

4.8

CVSS

MEDIUM

Stored XSS

CWE

Product Name: Tagregator

Affected Version From: 0.6

Affected Version To: 0.7.1

Patch Exists: YES

Related CWE: CVE-2018-10752

CPE: 2.3:a:wordpress:tagregator

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: CentOS 6.5

2018

WordPress Plugin Tagregator 0.6 – Cross-Site Scripting

WordPress Plugin Tagregator 0.6 is vulnerable to a stored cross-site scripting vulnerability. An attacker can inject malicious JavaScript code into the title field of the plugin's settings page, which is then stored in the database. When another administrator visits the page, the malicious code is executed.

Mitigation:

To mitigate this vulnerability, users should update to the latest version of the plugin, which is version 0.7.1.

Source

Exploit-DB raw data:

# Exploit Title: WordPress Plugin Tagregator 0.6 - Cross-Site Scripting
# Date: 2018-05-05
# Exploit Author: ManhNho
# Vendor Homepage: https://wordpress.org/plugins/tagregator/
# Software Link: https://downloads.wordpress.org/plugin/tagregator.0.6.zip
# Ref: https://pastebin.com/ZGr5tyP2
# Version: 0.6
# Tested on: CentOS 6.5
# CVE : CVE-2018-10752
# Category : Webapps

# 1. Description
# WordPress Plugin Tagregator 0.6 - Stored XSS

# 2. Proof of Concept

1. Login to admin panel
2. Access to Wordpress Tagregator setting, then choose Tweets/Instagram
Media/Flickr Post/Google+ Activities and click "Add New" button
3. In title field, inject XSS pattern such as:
    <script>alert('xss')</script> and click Preview button
4. This site will response url that will alert popup named xss
5. Send this xss url to another administrators, we have same alert