Howdy!
This is going to be a short write up about one of the security vulnerabilities issued by WordPress on their security patch release [CVE-2019-17674 & CVE-2020-11025].
I reported this issue way back March 30, 2018 thru their bug bounty program on HackerOne.
This issue was due to a vulnerable feature of WordPress which is the Navigation Menu. In the Menu there is a input box for Social Media links which may allow any site owner to input their Social Media profile links. The previous version of WordPress didn't sanitize any HTML Code for the link input which makes the feature vulnerable to Cross Site Scripting.
When a user adds a Cross Site Scripting payload in the Social Media input and publish the edited page, the payload will trigger on the home page of the owner's WordPress site.
In my test, I published a live demo of the vulnerability which you can check here https://ewsrtest.wordpress.com/
Again, this issue was already fixed by WordPress.
--Proof of Concept--
- go to https://wordpress.com/customize/<name>.wordpress.com
- click the "Menus" tab in the left side
- click "Social Media"
- choose any tab from "Facebook, Linkedin, Twitter and Instagram"
- after you choose a tab, input xss payload in the "Navigation Label"
- click Publish
- go to domain and see the result.
--Timeline--
Report Title: Stored XSS through nav menu item edited in Customizer
Reported: 2018-03-30 08:11:34 +0000
Patch Release: October 14, 2019
Reward: $600
Press Release of the issue
https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
https://www.symantec.com/security-center/vulnerabilities/writeup/110406
https://www.securityweek.com/wordpress-524-patches-six-vulnerabilities
https://www.softpedia.com/progChangelog/WordPress-Changelog-35303.html
I hope you enjoy this write up, have a great day y'all!
"We may encounter many defeats but we must not be defeated."
-Maya Angelou
