WordPress Blog2Social plugin CVE-2019-9576 XSS

Description

The Blog2Social WordPress plugin is vulnerable to reflected XSS as it echoes the b2s_update_publish_date parameter without proper encoding.

Successful exploitation allows an attacker to execute JavaScript in the context of the application in the name of an attacked user. This in turn enables an attacker to bypass CSRF protection and thus perform any actions the legitimate user can perform, as well as read data which the user can access.

Proof of Concept

http://192.168.0.103/wordpress/wp-admin/admin.php?page=blog2social-ship&postId=70&b2s_action=1&b2s_update_publish_date='"&gt;<img src>

Code

blog2social/includes/Loader.php:                    
echo '<div><p>' . __('This post will be shared into your social media on', 'blog2social') . ' ' . $_GET['b2s_update_publish_date'] . ' <a target="_blank" href>' . __('show details', 'blog2social') . '</a></p></div>';

WordPress Blog2Social plugin CVE-2019-9576 XSS最先出现在CVE 0day。