Kanban Boards for WordPress < 2.5.21 – Admin+ Stored XSS | CVE 2023-0873

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

1. Go to https://example.com/wp-admin/admin.php?page=kanban_settings#tab-statuses.

2. Click the button "Add another status".

3. Name of the status should be: <script>alert(1)</script>, and save your settings.

4. Go to https://example.com/wp-admin/admin.php?page=kanban_settings#tab-users, and check every user under Allowed Users.

5. As any user, go to https://example.com/?board_id=1&kanban=board, and XSS will be triggered for any logged-in user.