Widget Bundle <= 2.0.0 - Admin+ Stored XSS

2024-05-3100:00:00

Bob Matyas

wpscan.com

widget bundle plugin

admin privilege

stored xss

cross-site scripting

unsanitized settings

high privilege user

multisite setup

text form widget

5.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

PoC

1. Enable the “Text Form” widget 2. Add the widget and set the title to " style=animation-name:rotation onanimationstart=alert(/XSS/)// 3. Save and see the XSS