Chat Bubble < 2.3 - Unauthenticated Stored Cross-Site Scripting

2022-10-1800:00:00

Juampa Rodríguez

plugin settings

unauthenticated

stored xss

contact bubble

callback dashboard

exploit

0.001 Low

EPSS

Percentile

45.9%

JSON

The plugin does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact message

Setup:
- In the General Settings of the plugin, check the "Show Chat Bubble at website" checkbox and save.
- In the "Bubble Items" enable the "Simple CallBack" and save.

Attacker (unauthenticated):
- Access the blog and click on the contact bubble.
- In any of the offered fields (fname or fphone), enter the following payload and click "Submit": <script>alert(/XSS/)</script>

The XSS will be triggered when an admin will view the related Callback Message via the Callback dashboard (/wp-admin/edit.php?post_type=cbb_callback => /wp-admin/post.php?post=21&action=edit)

0.001 Low

EPSS

Percentile

45.9%

JSON

Related for WPEX-ID:012C5B64-EF76-4539-AFD8-40F6C329AE88