Headline

CVE-2023-5618: Changeset 2980695 for modern-footnotes – WordPress Plugin Repository

The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s shortcode in versions up to, and including, 1.4.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

1 year ago

CVE

Open in Source

#xss #web #ios #java #wordpress #php #auth

modern-footnotes/trunk/modern-footnotes.php

r2879914

r2980695

Text Domain: modern-footnotes

Description: Add inline footnotes to your post via the footnote icon on the toolbar for editing posts and pages. Or, use the [mfn] or [modern_footnote] shortcodes [mfn]like this[/mfn].

Version: 1.4.16

Version: 1.4.17

Author: Prism Tech Studios

Author URI: http://prismtechstudios.com/

…

defined( ‘ABSPATH’ ) or die( ‘No script kiddies please!’ );

$modern_footnotes_version = '1.4.16’;

$modern_footnotes_version = '1.4.17’;

$modern_footnotes_options = get_option(‘modern_footnotes_settings’);

…

140

// If additional space-seperated classes are provided to an individual footnote using [mfn class="some-class"], they are added to the footnote

141

if (isset($atts[‘class’])) {

142

$additional\_classes .= $atts\['class'\].' ';

142

$additional\_classes .= esc\_attr($atts\['class'\]).' ';

143

}

144

…

166

if (isset($atts\['referencenumber'\])) {

167

    $display\_number = $atts\['referencenumber'\];

168

    $additional\_attributes = 'refnum="' . $display\_number . '"';

168

    $additional\_attributes = 'refnum="' . esc\_attr($display\_number) . '"';

169

} else if (!isset($modern\_footnotes\_all\_posts\_data\[$scope\_id\]) || count($modern\_footnotes\_all\_posts\_data\[$scope\_id\]\['used\_reference\_numbers'\]) == 0) {

170

    $display\_number = 1;

…

199

200

//create a unique ID to use in HTML

201

$content_id = "mfn-content-" . $scope_id . '-' . preg_replace('/[^a-zA-Z0-9-_]/i’, '’, $display_number);

201

$content_id = "mfn-content-" . $scope_id . '-' . preg_replace('/[^a-zA-Z0-9-_]/i’, '’, esc_attr($display_number));

202

203

if (isset($atts[‘for_rss_feed’]) && $atts[‘for_rss_feed’]) {

204

$content = '<sup class="modern-footnotes-footnote ' . $additional\_classes . '">' . $display\_number . '</sup>'; // only display the superscript for RSS feeds

204

$content = '<sup class="modern-footnotes-footnote ' . $additional\_classes . '">' . esc\_html($display\_number) . '</sup>'; // only display the superscript for RSS feeds

205

} else {

206

$content = '<sup class="modern-footnotes-footnote ' . $additional\_classes . '" data-mfn="' . str\_replace('"',"\\\\\\"", $display\_number) . '" data-mfn-post-scope="' . $scope\_id . '">' .

206

$content = '<sup class="modern-footnotes-footnote ' . $additional\_classes . '" data-mfn="' . str\_replace('"',"\\\\\\"", esc\_attr($display\_number)) . '" data-mfn-post-scope="' . $scope\_id . '">' .

207

              '<a href="javascript:void(0)" ' . $additional\_attributes . ' role="button" aria-pressed="false" aria-describedby="' . $content\_id . '">' . $display\_number . '</a>' .

208