Lucene search
Felipe Restrepo RodriguezWPVDB-ID:8886EC5F-8465-448F-ADBD-68A3E84C5DECHistoryApr 25, 2023 - 12:00 a.m.
Ko-fi Button < 1.3.3 - Admin+ Stored XSS
2023-04-2500:00:00
Felipe Restrepo Rodriguez
wpscan.com
4
ko-fi
stored cross-site scripting
xss
vulnerability
plugin
settings
high-privilege users
unfiltered_html
capability
poc
multisite setup
low risk
tag
page
software
0.0004 Low
EPSS
Percentile
14.1%
The plugin does not properly some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup), and we consider it a low risk.
PoC
1. In the Kofi plugin settings, change the “Button Text” field to:  2. Add the [kofi] tag to one of your pages 3. View that page and see the XSS
| CPE | Name | Operator | Version |
|---|---|---|---|
| ko-fi-button | lt | 1.3.3 |
Related
prion
prion
Cross site scripting
2023-08-16 12:15:00
cve
cve
CVE-2023-2254
2023-08-16 12:15:12
cvelist
cvelist
CVE-2023-2254 Ko-fi Button < 1.3.3 - Admin+ Stored XSS
2023-08-16 11:03:29
nvd
nvd
CVE-2023-2254
2023-08-16 12:15:12
wpexploit
wpexploit
Ko-fi Button < 1.3.3 - Admin+ Stored XSS
2023-04-25 00:00:00
wordfence
wordfence