WordPress Category Posts Widget Stored XSS Vulnerability (CVE-2024-6158)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Plugin Name: Category Posts Widget (Free < 4.9.17, Pro < 4.9.13) 2. Plugin Versions: - Free version: < 4.9.17 - Pro version: < 4.9.13 3. Vulnerability Type: Admin+ Stored XSS 4. Plugin Description: The plugin fails to properly validate and escape certain settings when outputting "Category Posts" configuration, allowing users with high privileges (such as administrators) to execute stored cross-site scripting attacks when unfiltered HTML capability is disabled. 5. PoC: By adding a specific payload in the "Category Posts" plugin, an XSS attack can be triggered on the frontend. 6. Affected Plugins: - category-posts - term-and-category-based 7. CVE ID: CVE-2024-6158 8. URL: https://research.cleantalk.org/cve-2024-6158/ 9. Classification: - Type: XSS - OWASP Top 10: A7: Cross-Site Scripting (XSS) - CWE: CWE-79 10. Original Researcher: Dmitrii Ignatyev 11. Submitter: Dmitrii Ignatyev 12. Submitter Website: https://www.linkedin.com/in/dmitriy-ignatyev-8a9189267/ 13. Verification Status: Verified 14. WPVDB ID: 8adb219f-f0a6-4e87-8626-db26e300c220 15. Publication Date: 2024-07-19 16. Added Date: 2024-07-19 17. Last Updated: 2024-07-19 18. Related Articles: - 2017-05-23: Newsletter by Supsystic - Authenticated Stored XSS & CSRF - 2021-09-20: WordPress to Hootsuite (< 1.3.9) & Buffer (< 3.7.5) - Reflected Cross-Site Scripting - 2021-08-04: WP Customize Login <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS) - 2023-08-16: Video Grid < 1.22 - Reflected XSS - 2021-08-05: WP Mapa Politico Espana < 3.7.0 - Authenticated Stored Cross-Site Scripting This information helps understand the vulnerability's details, affected plugin versions, type, PoC, verification status, and related research.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Category Posts Widget Stored XSS Vulnerability (CVE-2024-6158)

More from this source