WordPress Plugin Vulnerabilities

Easy Social Icons < 3.0.9 - Reflected Cross-Site Scripting

Description

The plugin does not escape the $_SERVER['PHP_SELF'] input before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

https://example.com/wp-admin/admin.php/</script><script>alert(/XSS/)</script>/?page=cnss_social_icon_page

Affects Plugins

Plugin icon
easy-social-icons
Fixed in 3.0.9

References

CVE
CVE-2021-39322
URL
https://www.wordfence.com/blog/2021/09/php_selfish-part-2-reflected-xss-in-easy-social-icons/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Ram Gall (Wordfence)
Verified
Yes
WPVDB ID
5e0bf0b6-9809-426b-b1d4-1fb653083b58

Timeline

Publicly Published
2021-08-30 (about 2 years ago)
Added
2021-09-01 (about 2 years ago)
Last Updated
2022-04-09 (about 2 years ago)

Other

Published
Title
Published
2018-07-17
Title
FV Flowplayer Video Player 6.1.2-6.6.4 - Unspecified Cross-Site Scripting (XSS)
Published
2016-05-20
Title
brafton WordPress Plugin <=3.4.7 - Reflected XSS
Published
2023-09-25
Title
Pretty Google Calendar < 1.6.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via pretty_google_calendar shortcode
Published
2015-04-26
Title
WordPress <= 4.2 - Unauthenticated Stored Cross-Site Scripting (XSS)
Published
2023-11-09
Title
Additional Order Filters for WooCommerce < 1.12 - Reflected XSS