Author: Dmitrii I

While evaluating the plugin, we uncovered a vulnerability that permits the execution of Stored Cross-Site Scripting (XSS) on behalf of a contributor. This vulnerability is exploited by inserting a shortcode into a newly created post, potentially resulting in an account takeover.

Main info:

CVE	CVE-2023-4795
Plugin	Testimonial Slider Shortcode
Critical	High
Publicly Published	September 25, 2023
Last Updated	September 25, 2023
Researcher	Dmtirii Ignatyev
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	Will be later
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4795 https://wpscan.com/vulnerability/b8390b4a-b43f-4bf6-a61b-dfcbc7b2e7a0
Plugin Security Certification by CleanTalk

Timeline

Discovery of the Vulnerability

During a thorough evaluation of the Testimonial Slider Shortcode plugin, a significant security vulnerability was uncovered. This vulnerability allows for the execution of Stored Cross-Site Scripting (XSS) attacks through the use of a shortcode within a new post. Intriguingly, this security loophole can be exploited by contributors and users with elevated privileges, potentially leading to unauthorized account access.

Understanding of Stored XSS attack’s

Stored Cross-Site Scripting (XSS) represents a type of security vulnerability where malicious scripts are inserted into a web application and then stored for future execution when other users interact with the affected content. In the context of this vulnerability, attackers can utilize shortcodes to store and subsequently execute malicious JavaScript code.

Exploiting the Stored XSS

Exploiting the Stored XSS vulnerability within the Testimonial Slider Shortcode plugin involves the insertion of malicious code within a shortcode by an attacker with contributor-level privileges or higher. The injected code may include payloads designed to steal user data, impersonate users, or execute actions on behalf of the compromised contributor account. Attackers can create seemingly innocuous posts that, upon viewing, trigger the execution of the malicious script.

POC shortcode:

[tss_item text=»Abelson has been an amazing firm to work with. Lorem changed the company.» name=»JOHN SAMPSON LP» link=’” onmouseover=”alert(/XSS/)”‘/]

This is shortcode which you can add to new post

Despite the requirement for contributor-level privileges, CVE-2023-4795 poses substantial risks. An attacker who successfully exploits this vulnerability can:

• Execute arbitrary code within the context of other users’ browsers.
• Pilfer sensitive data such as cookies or session information.
• Gain unauthorized access to the compromised contributor’s account.
• Assume the identity of contributors to carry out nefarious actions on the website.

In a real-world scenario, envision an attacker leveraging this vulnerability to compromise a contributor’s account on a website employing the Testimonial Slider Shortcode plugin. By embedding a malicious shortcode in a seemingly harmless post, they can execute an XSS attack on anyone who views the manipulated content. This could result in unauthorized account access, data breaches, and harm to the website’s reputation.

Recommendations for Improved Security

To mitigate the risks posed by CVE-2023-4795 and enhance the overall security of WordPress websites employing the Testimonial Slider Shortcode plugin, consider the following recommendations:

• Plugin updates: Ensure the Testimonial Slider Shortcode plugin is kept up to date, specifically to version 1.1.9 or later, which should contain a patch addressing this vulnerability.
• Input validation and sanitization: Developers should implement stringent input validation and data sanitization to prevent the injection of malicious code through shortcodes or other user inputs.
• Least privilege principle: Restrict the capabilities and permissions of contributors and other user roles to minimize the potential impact of a compromised account.
• Regular security assessments: Routinely conduct security audits and penetration testing to proactively identify and address vulnerabilities.
• User education: Educate contributors and administrators about potential security threats and best practices for securely using and managing plugins and shortcodes.

By adhering to these recommendations, website administrators can significantly reduce the risk of Stored XSS attacks and enhance the overall security posture of their WordPress installations, even for vulnerabilities that may require contributor-level privileges.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #HighVulnerability

Use CleanTalk solutions to improve the security of your website

Dmitrii i.

If you think your website is infected and you need help, contact us for malware cleanup. Our specialists will provide you with professional assistance in cleaning your website from malware.

Check my website

During testing, a vulnerability was found that allows, through changing the settings, to implement Stored XSS on all pages where there is a mention of the plugin. This vulnerability is available on behalf of the administrator and allows you to leave javascript “backdoor” when capturing an administrative account, which will allow account takeover. Unfiltered_html capability is prohibited

Main info:

CVE	CVE-2023-4725
Plugin	Simple Posts Ticker
Critical	Medium
Publicly Published	September 25, 2023
Last Updated	September 25, 2023
Researcher	Dmtirii Ignatyev
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	Will be later
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4725 https://wpscan.com/vulnerability/e9b9a594-c960-4692-823e-23fc60cca7e7
Plugin Security Certification by CleanTalk

Timeline

Discovery of the Vulnerability

During the process of comprehensive security testing, a critical vulnerability was unearthed in the Simple Posts Ticker plugin, specifically a Stored Cross-Site Scripting (XSS) flaw. This vulnerability enables an attacker to execute malicious code, impersonating an administrator, by manipulating the plugin’s settings. Despite requiring administrator-level privileges, this vulnerability still poses a significant threat to website security.

Understanding of Stored XSS attack’s

Stored Cross-Site Scripting (XSS) is a type of security vulnerability where malicious scripts are injected into a web application and subsequently stored for later execution when unsuspecting users access the affected content. In the context of this vulnerability, an attacker can leverage the plugin’s settings to store and execute malicious JavaScript code.

Exploiting the Stored XSS

Exploiting the Stored XSS vulnerability in the Simple Posts Ticker plugin requires administrator-level access to manipulate the plugin’s settings. An attacker can insert malicious code, such as JavaScript payloads, into the settings fields. When the settings are saved, the malicious code is stored and executed whenever the administrator interacts with the plugin, potentially leading to the compromise of their account.

POC:

3px;”><img src=x onerror=alert(1)>

Despite the need for administrator privileges to exploit CVE-2023-4725, the potential risks associated with this vulnerability are severe. An attacker who successfully compromises an administrative account through this Stored XSS flaw can:

• Gain unauthorized access to sensitive website functions.
• Modify content, settings, and configurations.
• Create “backdoors” in the form of JavaScript code to maintain control.
• Launch further attacks, such as privilege escalation or data theft.

In a real-world scenario, imagine an attacker exploiting this vulnerability to compromise an administrator’s account on a website that uses the Simple Posts Ticker plugin. They could inject malicious JavaScript code into the plugin’s settings, enabling them to control the administrator’s account and potentially carry out actions that damage the website’s reputation and integrity.

Recommendations for Improved Security

To mitigate the risk posed by CVE-2023-4725 and enhance the overall security of WordPress websites using the Simple Posts Ticker plugin, the following recommendations should be followed:

• Update the plugin: Ensure the Simple Posts Ticker plugin is updated to the latest version (1.1.6 or higher), which should contain a patch addressing this vulnerability.
• Input validation and sanitization: Developers should implement rigorous input validation and data sanitization to prevent the injection of malicious code in settings fields.
• Regular security audits: Conduct routine security audits and penetration testing to identify and rectify vulnerabilities proactively.
• Least privilege principle: Limit the capabilities and permissions of administrator accounts to reduce the potential damage caused by a compromised administrative account.
• User awareness and education: Educate administrators about potential security threats and best practices for securely configuring and managing plugins.

By adhering to these recommendations, website administrators can significantly reduce the risk of Stored XSS attacks and enhance the overall security posture of their WordPress installations, even for vulnerabilities requiring administrator privileges.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #MediumVulnerability

Use CleanTalk solutions to improve the security of your website

Dmitrii i.

If you think your website is infected and you need help, contact us for malware cleanup. Our specialists will provide you with professional assistance in cleaning your website from malware.

Check my website

While examining the plugin during the testing phase, we uncovered a vulnerability that enables the execution of Stored Cross-Site Scripting (XSS) attacks, accomplished by incorporating a shortcode into a new post. This vulnerability has the potential to lead to the compromise of user accounts, particularly those of contributors.

Main info:

CVE	CVE-2023-4646
Plugin	Simple Posts Ticker
Critical	High
Publicly Published	September 25, 2023
Last Updated	September 25, 2023
Researcher	Dmtirii Ignatyev
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	Will be later
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4646 https://wpscan.com/vulnerability/c34f8dcc-3be6-44ad-91a4-7c3a0ce2f9d7
Plugin Security Certification by CleanTalk

Timeline

Discovery of the Vulnerability

While conducting an extensive plugin security assessment, a critical vulnerability was uncovered in the Simple Posts Ticker plugin. Specifically, this vulnerability allows an attacker to execute Stored Cross-Site Scripting (XSS) attacks by utilizing a shortcode within a new post. Importantly, this flaw can be exploited by contributors or users with higher privileges and could potentially lead to unauthorized account access.

Understanding of Stored XSS attack’s

Stored Cross-Site Scripting (XSS) is a type of security vulnerability where malicious scripts are inserted into a web application and stored for later execution when accessed by other users. In the context of this vulnerability, attackers can leverage shortcodes to store and execute malicious JavaScript code.

Exploiting the Stored XSS

Exploiting the Stored XSS vulnerability within the Simple Posts Ticker plugin necessitates the insertion of malicious code within a shortcode by an attacker with contributor-level or higher privileges. The inserted code can include payloads designed to steal user data, impersonate users, or execute actions on behalf of the compromised contributor account. Attackers can create deceptive posts that, when viewed, execute the malicious script.

POC shortcode:

[spt-posts-ticker label_text_size=’” onmouseover=”alert(/XSS/)”‘ label_text=”123123″]

This is shortcode which you can add to new post

Despite requiring contributor-level privileges, CVE-2023-4646 poses significant risks. An attacker who successfully exploits this vulnerability can:

• Execute arbitrary code within the context of other users’ browsers.
• Steal sensitive data like cookies or session information.
• Gain unauthorized access to the compromised contributor’s account.
• Impersonate contributors to perform malicious actions on the website.

In a real-world scenario, envision an attacker leveraging this vulnerability to compromise a contributor’s account on a website employing the Simple Posts Ticker plugin. By embedding a malicious shortcode in a seemingly innocuous post, they can execute an XSS attack on anyone who views the manipulated content. This could result in unauthorized account access, data breaches, and damage to the website’s reputation.

Recommendations for Improved Security

To mitigate the risks posed by CVE-2023-4646 and bolster the overall security of WordPress websites utilizing the Simple Posts Ticker plugin, consider the following recommendations:

• Plugin updates: Ensure the Simple Posts Ticker plugin is kept up to date, specifically to version 1.1.6 or later, which should contain a patch addressing this vulnerability.
• Input validation and sanitization: Developers should implement rigorous input validation and data sanitization to prevent the injection of malicious code through shortcodes or other user inputs.
• Least privilege principle: Restrict the capabilities and permissions of contributors and other user roles to minimize the potential impact of a compromised account.
• Routine security assessments: Regularly conduct security audits and penetration testing to proactively identify and address vulnerabilities.
• User education: Educate contributors and administrators about potential security threats and best practices for securely using and managing plugins and shortcodes.

By adhering to these recommendations, website administrators can significantly reduce the risk of Stored XSS attacks and enhance the overall security posture of their WordPress installations, even for vulnerabilities that may require contributor-level privileges.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #HighVulnerability

Use CleanTalk solutions to improve the security of your website

Dmitrii i.

If you think your website is infected and you need help, contact us for malware cleanup. Our specialists will provide you with professional assistance in cleaning your website from malware.

Check my website

During the plugin’s testing phase, a vulnerability was identified that enables the execution of Stored XSS by an attacker who embeds a shortcode in a new post, potentially leading to an account takeover.

Main info:

CVE	CVE-2023-4798
Plugin	User Avatar – Reloaded
Critical	High
Publicly Published	September 25, 2023
Last Updated	September 25, 2023
Researcher	Dmtirii Ignatyev
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	Will be later
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4798 https://wpscan.com/vulnerability/273a95bf-39fe-4ba7-bc14-9527acfd9f42
Plugin Security Certification by CleanTalk

Timeline

Discovery of the Vulnerability

While conducting a security assessment of the User Avatar – Reloaded plugin, a critical vulnerability was identified. This vulnerability allows for the execution of Stored Cross-Site Scripting (XSS) attacks, carried out on behalf of a contributor-level user by embedding a malicious shortcode within a new post. This security flaw poses a significant threat as it enables attackers to gain control over user accounts and potentially compromise the integrity of the website.

Understanding of Stored XSS attack’s

Stored Cross-Site Scripting (XSS) is a type of security vulnerability that occurs when an application does not properly validate and sanitize user inputs. It allows an attacker to inject malicious scripts into a website, which are then stored and executed when other users view the affected content. This can lead to a range of malicious actions, including data theft, session hijacking, or even complete website compromise.

Exploiting the Stored XSS

Exploiting the Stored XSS vulnerability in the User Avatar – Reloaded plugin involves an attacker with contributor-level access inserting malicious code within a shortcode. This code can include payloads designed to steal user cookies, impersonate users, or perform actions on behalf of the compromised contributor account. Attackers can craft convincing phishing attempts, potentially leading to the compromise of sensitive data and accounts.

POC shortcode:

[avatar user=”admin” size=”96″ align=”left” link=’” onmouseover=”alert(/XSS/)”‘ /]

This is shortcode which you can add to new post

The potential risks associated with CVE-2023-4798 are substantial. An attacker could compromise the accounts and privacy of contributors and potentially escalate their access to perform more malicious actions. This could include posting harmful content, stealing user data, or manipulating website functionality.

In a real-world scenario, imagine an attacker gaining access to a contributor-level account on a website using the User Avatar – Reloaded plugin. By embedding a malicious shortcode in a post, they can target and compromise the accounts of unsuspecting users who view the manipulated content. This could lead to unauthorized access, data breaches, and a loss of trust in the website’s security.

Recommendations for Improved Security

To mitigate the risk posed by CVE-2023-4798 and enhance the overall security of WordPress websites using the User Avatar – Reloaded plugin, the following recommendations should be considered:

• Update the plugin: Website administrators should promptly update the User Avatar – Reloaded plugin to version 1.2.2 or later, which should include a patch to address this vulnerability.
• Input validation: Developers should implement robust input validation and output encoding to prevent malicious code injection through shortcodes or other user inputs.
• User privilege management: Limit contributors’ capabilities and restrict access to critical functionalities, reducing the potential damage caused by compromised contributor accounts.
• Regular security audits: Conduct routine security audits and penetration testing on your WordPress website to identify and address vulnerabilities proactively.
• User awareness and education: Train contributors and administrators to recognize potential security threats, emphasizing the importance of safe shortcode usage and adherence to security best practices.

By following these recommendations, website owners can significantly reduce the risk of Stored XSS attacks and enhance the overall security posture of their WordPress installations.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #HighVulnerability

Use CleanTalk solutions to improve the security of your website

Dmitrii i.

If you think your website is infected and you need help, contact us for malware cleanup. Our specialists will provide you with professional assistance in cleaning your website from malware.

Check my website

During testing, a critical vulnerability was discovered in the plugin, namely a vulnerability in the Directory Listings system, which allows an unauthorized user to view and download private files of other users. This vulnerability poses a serious security threat because it allows an attacker to gain access to confidential data and files of other users without their permission.

Main info:

CVE	CVE-2023-4933
Plugin	WP Job Openings
Critical	High
Publicly Published	September 25, 2023
Last Updated	September 25, 2023
Researcher	Dmtirii Ignatyev
OWASP TOP-10	A3: Sensitive Data Exposure
PoC	Yes
Exploit	Will be later
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4933 https://wpscan.com/vulnerability/882f6c36-44c6-4273-81cd-2eaaf5e81fa7
Plugin Security Certification by CleanTalk

Timeline

Discovery of the Vulnerability

While conducting a comprehensive security assessment of the WP Job Openings plugin, a critical vulnerability was identified in its Directory Listings system. This vulnerability allows unauthorized users to access and download private files belonging to other users. This security flaw is of utmost concern as it enables attackers to gain access to sensitive data and files without any authorization.

Understanding of Directory Listing attack’s

Directory Listing, in the context of web servers, refers to the practice of displaying the contents of a directory when an index file (like index.html or index.php) is absent. Without proper security measures in place, this can lead to unintended exposure of files and directories to anyone who accesses the directory through a web browser. For example, if an attachment directory doesn’t have an index file and the web server’s autoindex feature is enabled, it may display a list of files and directories to visitors.

Imagine a scenario where the WP Job Openings plugin stores attachments related to job applications in a directory without proper access controls or an index file. If an attacker knows or guesses the directory’s path, they can easily view and download attachments submitted by other users.

Exploiting the Directory Listing

Exploiting the Directory Listing vulnerability in WP Job Openings requires little technical skill. An attacker needs to:

• Identify the target directory where attachments are stored, often through educated guesses or publicly available information.
• Use a web browser to access the directory directly.
• If the directory listing is enabled and lacks proper access controls, the attacker can view and download files belonging to other users.

This straightforward process allows attackers to access private attachments and potentially expose sensitive information, such as resumes, cover letters, and personal details submitted by job applicants.

POC:

1. You can find directory listing inside this URL http://your_site/wordpress/wp-content/uploads/awsm-job-openings/2023/09/

Potential Risks and Real-World Impact

The potential risks associated with CVE-2023-4933 are substantial. An attacker could compromise the privacy and confidentiality of job applicants by accessing their personal documents. In addition, sensitive corporate data, including resumes, contact information, and internal job-related documents, may also be exposed.

In a real-world scenario, consider an attacker who accesses a directory storing job application attachments through the vulnerability in the WP Job Openings plugin. They may use the gathered information for malicious purposes, such as identity theft, spear-phishing, or selling sensitive data on the dark web. Furthermore, if the affected organization handles highly regulated data (e.g., personal health information or financial records), this exposure could lead to legal and compliance issues.

Recommendations for Improved Security

To mitigate the risk posed by CVE-2023-4933 and enhance the overall security of WordPress websites using the WP Job Openings plugin, the following recommendations should be followed:

1. Update the plugin: Website administrators should promptly update the WP Job Openings plugin to version 3.4.3 or later, which should include a patch to address this vulnerability.
2. Implement access controls: Developers should configure proper directory permissions and access controls to prevent unauthorized directory listings and file access.
3. Disable directory listing: Ensure that directory listing is disabled in the web server’s configuration, especially for directories containing sensitive data.
4. Security monitoring: Implement continuous security monitoring to detect and respond to potential vulnerabilities or attacks promptly.
5. Regular audits: Perform routine security audits and penetration testing to identify and address security weaknesses in WordPress plugins and themes.
   

By following these recommendations, website owners can significantly reduce the risk of sensitive data exposure through directory listings and enhance the overall security posture of their WordPress installations.

#WordPressSecurity #DirectoryListing #WebsiteSafety #StayProtected #HighVulnerability

Use CleanTalk solutions to improve the security of your website

Dmitrii i.

If you think your website is infected and you need help, contact us for malware cleanup. Our specialists will provide you with professional assistance in cleaning your website from malware.

Check my website

In the process of testing the plugin, a vulnerability was found that allows you to implement Stored XSS on behalf of the contributor by embedding the shortcode in a new post, which entails account takeover

Main info:

CVE	CVE-2023-4289
Plugin	WP Matterport Shortcode
Critical	High
Publicly Published	September 25, 2023
Last Updated	September 25, 2023
Researcher	Dmtirii Ignatyev
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	Will be later
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4289 https://wpscan.com/vulnerability/38c337c6-048f-4009-aef8-29c18afa6fdc
Plugin Security Certification by CleanTalk

Timeline

Discovery of the Vulnerability

During the process of plugin testing, a vulnerability was uncovered in WP Matterport Shortcode. This vulnerability allows for the execution of Stored Cross-Site Scripting (XSS) attacks, carried out on behalf of a contributor-level user by embedding a malicious shortcode within a new post. This security flaw could potentially lead to account takeover and poses a significant threat to website security.

Understanding Cross-Site Scripting (XSS)

Stored Cross-Site Scripting (XSS) is a type of security vulnerability that occurs when an application does not properly validate user inputs and subsequently renders malicious scripts within a web page or application. In the context of this vulnerability, a contributor can inject harmful code via a shortcode that remains stored on the website server. When unsuspecting users view the compromised content, the malicious script is executed within their browsers, allowing attackers to steal sensitive information, impersonate users, or carry out other malicious actions.

Exploiting the Stored Cross-Site Scripting (XSS) vulnerability

Exploiting the Stored XSS vulnerability in WP Matterport Shortcode involves an attacker with contributor-level access inserting malicious code within a shortcode. This code could include payloads to steal user cookies, redirect users to malicious websites, or perform actions on behalf of the compromised contributor account. Attackers can craft convincing phishing attempts, compromising the security and trustworthiness of the affected website.

POC shortcode:

[matterport cols=”3″ src=”https://wordpress.org/plugins/shortcode-gallery-for-matterport-showcase/uKDy9xrMRCi,wV4vX743ATF” width=’900 ” onmouseover=”alert(12312123312)’]

This shortcode can be inserted into a new post

Potential Risks and Real-World Impact

The potential risks associated with this vulnerability are significant. An attacker could use the compromised contributor account to post malicious content or links, thereby damaging the reputation of the website. Furthermore, if the compromised contributor has higher privileges, the attacker may escalate their access to perform more malicious actions, such as deleting content or gaining administrative control.

In a real-world scenario, a contributor’s account could be taken over by an attacker who injects a rogue shortcode into a post. Unsuspecting visitors to the site may then fall victim to the XSS attack, leading to a breach of their personal data or exposure to harmful content.

1. Unauthorized Data Access:
   Attackers could exploit the XSS vulnerability to steal sensitive user data, such as login credentials or personal information.
   
2. Cookie Theft:
   Malicious scripts could hijack user cookies, leading to unauthorized access to user accounts or session hijacking. After account takeover attacker can insert malicious PHP code on page and it will be RCE.
   
3. Malicious Content Distribution:
   Attackers might use the vulnerability to inject harmful content or links into the website, potentially damaging the site’s reputation or spreading malware.

Recommendations for Improved Security

To mitigate the risks associated with this vulnerability and enhance overall security, the following measures are strongly advised:

• Update to the latest version:
  Website administrators should ensure that the WP Matterport Shortcode plugin is updated to the latest patched version, as the vendor may have already addressed this vulnerability.
  
• Input Validation and Escaping:
  Plugin developers must implement robust input validation and escaping mechanisms to ensure that all user-generated content, including shortcodes, is properly sanitized before rendering on the page.
  
• Regular Security Audits:
  Conduct regular security assessments and penetration tests on WordPress installations to identify and remediate potential vulnerabilities proactively.
  
• User Privilege Restriction:
  Implement strict access controls to ensure that users can only access information that they are authorized to view based on their roles and permissions.
  
• User Awareness:
  Educate website administrators and users about the risks of sharing sensitive information and the importance of strong, unique passwords.
  
  

By following these recommendations, website owners can reduce the risk of XSS attacks and enhance the overall security posture of their WordPress installations.

Use CleanTalk solutions to improve the security of your website

Dmitrii i.

If you think your website is infected and you need help, contact us for malware cleanup. Our specialists will provide you with professional assistance in cleaning your website from malware.

Check my website