Popular Brand SVG Icons - Simple Icons < 2.7.8 - Contributor+ Stored XSS

2021-07-0500:00:00

apple502j

svg icons

simple icons

version 2.7.8

stored xss

user interaction

click event

twenty twenty-one theme

payload

exploit

alert

security vulnerability

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not sanitise or validate some of its shortcode parameters, such as “color”, “size” or “class”, allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.

With minimum user interaction (depends on the theme, payload below is for Twenty Twenty-One):
[simple_icon name="wordpress" color='red;animation-name:twentytwentyone-close-button-transition;" onanimationstart="alert(origin);//' size="20px"]


With user interaction, such as a click (all themes):
[simple_icon name="wordpress" color='red;" onclick="alert(/XSS/);//' size="20px"]

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:18AB1570-2B4A-48A4-86E6-C1D368563691