WORDPRESS, XSS

CVE-2024-0602 — Yet Another Related Posts Plugin (YARPP) <= 5.30.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via settings

The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.30.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

The plugin provides a feature to customize wording for “excerpt”. These input is not sanitized, causing an XSS vulnerability.

Proof of Concepts

  1. Open YARPP Setting page /wp-admin/options-general.php?page=yarpp
  2. Scroll to section “Automatic Discplay Options”
  3. Put XSS Payload in “Before / after (excerpt): “ ` <img src onerror=alert(/XSS/)>`

Impact

This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.