Stored XSS Vulnerability in WordPress Table Field Add-on < 1.4.3 RC1 with POC

Vulnerability Overview Vulnerability Name: Table Field Add-on for ACF and BCF < 1.4.3 RC1 - Authenticated (Subscriber) Stored Cross-Site Scripting Targeting the Table Field Value Vulnerability Description: This vulnerability exists in the Table Field Add-on for ACF and BCF plugin, in versions lower than 1.4.3 RC1. The vulnerability type is Stored Cross-Site Scripting (XSS). An attacker can inject malicious scripts into the target website by crafting malicious input without requiring authentication. When other users access the page containing the malicious script, the script executes in their browsers, potentially leading to security issues such as session hijacking and sensitive information leakage. Scope of Impact Affected Plugin: Table Field Add-on for ACF and BCF Affected Versions: Lower than 1.4.3 RC1 Affected Users: WordPress site administrators and subscriber users who use this plugin Remediation Upgrade Plugin: It is recommended to immediately upgrade the Table Field Add-on for ACF and BCF plugin to version 1.4.3 RC1 or higher to fix this vulnerability. Code Review: Review the plugin code to ensure that all user inputs are appropriately filtered and escaped to prevent malicious script injection. Security Configuration: Strengthen the website's security configuration, such as enabling Content Security Policy (CSP), to reduce the risk of XSS attacks. POC Code Please note that the above POC code is for illustration purposes only. In actual use, adjustments must be made according to the specific environment.

Goal Reached Thanks to every supporter — we hit 100%!

Stored XSS Vulnerability in WordPress Table Field Add-on < 1.4.3 RC1 with POC

More from this source