WORDPRESS, XSS

CVE-2023-4839 — WP Go Maps <= 9.0.32 Administrator+ Stored Cross-Site Scritpting via Slider Callback

The WP Go Maps for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Proof of Concepts

  1. Go to the plugin page (/wp-admin/admin.php?page=master-slider) then create a new slider.
  2. Open the Slider that you have created then go to the Slider Callbacks tab
  3. Click “Add new callback” with any conditions (ex: On Youtube/Vimeo video close), then enter the XSS payload. 
    function(event){
 var api = event.target;
 </script><img src onerror=alert(/XSS/)>
}
  4. Create a new Post using the shortcode for the slider that has been created

If we directly use alert(\xss\), the XSS payload will not be triggered because it does not meet the required conditions. However, we bypass this condition using the closing script (</script>).

Impact

This makes it possible for authenticated attackers, with Administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.