Elfsight Telegram Chat CC <=1.1.0 Stored XSS via Missing Authorization (CVE-2024-10390)

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability Name: Elfsight Telegram Chat CC <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting 2. Vulnerability Type: Plugin vulnerability 3. Plugin Name: Elfsight Telegram Chat CC 4. Plugin Version: <= 1.1.0 5. Vulnerability Description: The plugin has a missing authorization check for data modification, allowing users with Subscriber+ level access to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 6. CVSS Score: 6.4 (Medium) 7. Public Release Date: November 18, 2024 8. Last Updated Date: November 18, 2024 9. Researcher: István Márton - Wordfence 10. CVE ID: CVE-2024-10390 11. Disclosure Status: Public 12. Fix Status: No known fix 13. Affected Versions: <= 1.1.0 14. Reference Link: codecanyon.net 15. Exploit Description: The plugin lacks proper authorization checks for data modification, enabling users with Subscriber+ privileges to inject arbitrary scripts into pages. These scripts execute when other users access the compromised page. 16. Impact: The plugin’s missing authorization check allows Subscriber+ users to inject malicious scripts into pages, which execute upon page access by other users. 17. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 18. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 19. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 20. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 21. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 22. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 23. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 24. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 25. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 26. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 27. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 28. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 29. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 30. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 31. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 32. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 33. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts execute when other users visit the compromised page. 34. Exploit: The plugin lacks authorization checks for data modification, allowing Subscriber+ users to inject arbitrary scripts into pages. These scripts

Goal Reached Thanks to every supporter — we hit 100%!

Elfsight Telegram Chat CC <=1.1.0 Stored XSS via Missing Authorization (CVE-2024-10390)