WordPress Tooltipy 5.0 Cross Site Scripting

Type packetstorm
Reporter Tom Adams
Modified 2018-06-12T00:00:00


Software: Tooltipy (tooltips for WP)  
Version: 5.0  
Homepage: https://wordpress.org/plugins/bluet-keywords-tooltip-generator/  
Advisory report: https://advisories.dxw.com/advisories/xss-in-tooltipy/  
CVE: Awaiting assignment  
CVSS: 5.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N)  
Reflected XSS in Tooltipy (tooltips for WP) could allow anybody to do almost anything an admin can  
Tootipy contains reflected XSS in the [kttg_glossary] shortcode meaning that admin usersa browsers can be hijacked by anybody who sends them a link. The hijacked browser can be made to do almost anything an admin user can normally do.  
Proof of concept  
Create a page containing the [kttg_glossary] shortcode  
Visit the new page, and add the following to the end of the URL: ?cat=\'><script>alert(1)</script>  
Youall see an alert in browsers without XSS prevention such as Firefox  
Upgrade to version 5.1 or later.  
Disclosure policy  
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://advisories.dxw.com/disclosure/  
Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.  
This vulnerability will be published if we do not receive a response to this report with 14 days.  
2018-03-29: Discovered  
2018-04-10: Reported to vendor via email (first attempt)  
2018-04-30: Asked if theyad received the email, via Facebook private message (second attempt)  
2018-05-03: Reported again via contact form (third attempt)  
2018-05-18: Reported to plugins@wordpress.org  
2018-05-18: WordPress plugin team disabled downloads of the plugin  
2018-05-21: Vendor reported a fix has been made for the bug (first contact from vendor)  
2018-06-05: Updated version of plugin is now available for download on wordpress.org  
2018-06-12: Advisory published  
Discovered by dxw:  
Tom Adams  
Please visit advisories.dxw.com for more information.