WordPress Plugin Vulnerabilities

Async JavaScript < 2.21.06.29 - Authenticated (admin+) Stored XSS

Description

The plugin does not validate or escape its Username and API Key from the Wizard tab of its settings, allowing high privilege users such as admin to set JavaScript payload in them, even when the unfiltered_html capability is disallowed, leading to Stored Cross-Site Scripting issues

Proof of Concept

Set the payload below in the Username and API Key fields to the Wizard tab of the settings (wp-admin/options-general.php?page=async-javascript&tab=wizard)

" style=animation-name:rotation onanimationstart=alert(/XSS/)//

Then click on Processed to Step 2 (which generate an error about the Username and key being incorrect), and reload the age to trigger the XSS

Affects Plugins

Plugin icon
async-javascript
Fixed in 2.21.06.29

References

URL
https://m0ze.ru/vulnerability/[2021-05-01]-[WordPress]-[CWE-79]-Async-JavaScript-WordPress-Plugin-v2.20.12.09.txt

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.8 (medium)

Miscellaneous

Original Researcher
m0ze
Verified
Yes
WPVDB ID
278f7c36-05f8-4b6f-9a13-11175e3f3971

Timeline

Publicly Published
2021-06-13 (about 2 years ago)
Added
2021-06-29 (about 2 years ago)
Last Updated
2022-03-05 (about 2 years ago)

Other

Published
Title
Published
2022-04-21
Title
Advanced Contact form 7 DB < 1.8.8 - Unauthenticated Stored Cross-Site Scripting
Published
2023-01-12
Title
Giveaways and Contests by RafflePress < 1.11.3 - Contributor+ Stored XSS
Published
2021-11-29
Title
Download Manager < 3.2.22 - Subscriber+ Stored Cross-Site Scripting
Published
2023-06-21
Title
WooCommerce Pre-Orders < 2.0.1 - Contributor+ Stored XSS
Published
2023-04-19
Title
WP-dTree <= 4.4.5 - Admin+ Stored XSS