Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Mufeng's Hermit ????? plugin <= 3.1.6 on WordPress via &title parameter.

*   Details
*   Reviews
*   Support
*   Development

This plugin has been closed as of April 25, 2022 and is not available for download. This closure is temporary, pending a full review.

知道该插件已经是好几年前了，之后很少有机会在网上写博客了，所以可能就不会再用到这个插件了，直到前几天又要做个小东西，我想到了这个插件，发现作者还在更新，百感交集，先不谈插件好不好，单单作者这份坚持和用心，就已经打动了我，当然，作者写的插件易用小巧，适用多环境下，这也是我第一次给WordPress widget评价，对作者的坚持表示敬佩和感谢。 PS：如果能支持一下微信小程序就更好了，现在我是通过Webview来使用的，经过简单的模板适配，依然适用！

用了两年了，作者一直有在不断更新！这是目前能用的到的最简洁、美观、实用的音乐播放插件，支持网易和虾米。虽然还有一部分音乐版权在QQ音乐手上，但是已经知足了，毕竟同类可以调用三者的插件UI简直辣眼睛。

Read all 4 reviews

“Hermit 音乐播放器” is open source software. The following people have contributed to this plugin.

Contributors

*    mu feng

CVE-2022-29413: Hermit 音乐播放器

Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in Mati Skiba @ Rav Messer's Ravpage plugin <= 2.16 at WordPress.

**ravpage**

**Software**

**Ravpage**

**Vulnerable Versions**

**<= 2.16**

**Fixed in version**

**CVE**

**CVE-2022-29415**

**References**

**Credits**

**Classification**

**Cross Site Scripting (XSS)**

**OWASP Top 10**

**A7: Cross-Site Scripting (XSS)**

**Disclosure Date**

**2022-04-28**

**CVSS 3.0 score**

**Can be exploited remotely without any authentication.**

**Plugin does not exist, is not supported or discontinued.**

**Are your websites subject to this vulnerability?**

**Details**

**Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability was discovered by Tien Nguyen Anh (Patchstak Alliance) in the WordPress Ravpage plugin (versions <= 2.16).**

**Solution**

**Deactivate and delete. This plugin has been closed as of April 21, 2022 and is not available for download. This closure is temporary, pending a full review.**

**Found a vulnerability that puts your sites at risk?**

**Found a vulnerability? Help us secure the web and join our community of ethical hackers.**

**Are you the developer of this software? Hire our researchers for a thorough security audit.**

CVE-2022-29415: WordPress Ravpage plugin <= 2.16 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) in Shea Bunge's Footer Text plugin <= 2.0.3 on WordPress.

This plugin **hasn’t been tested with the latest 3 major releases of WordPress**. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

**Description**

Provides an interface in the dashboard, similar to the post edit screen, that allows you to easily change the text displayed in the footer on the front-end. After installing the plugin, add the footer_text() template tag to your footer.php theme template where you want the text to display. For more options, see the FAQ.

You can use these shortcodes in the footer text editor:

*   [last_modified] the date that the current page was last modified on
*   [page_link] the full permalink of the current page, formatted. The content wrapped in this shortcode will be used as the link text
*   [year] the current year eg: 2013

Visit the plugin homepage, or contribute to its development at GitHub.

**Screenshots**

**Installation**

1.  Upload the footer-text directory to the /wp-content/plugins/ directory
2.  Activate the plugin through the ‘Plugins’ menu in WordPress
3.  Visit _Appearance > Footer Text_ to write your awesome footer text
4.  Place the footer_text() template tag somewhere in your theme where you want the text displayed
5.  Visit site. Observe.

**FAQ**

**How can I display the footer text in my theme?**

You can use the footer_text() function to display the footer text, or the get_footer_text() function to return it for use in PHP. These template tags should generally be used in the footer.php file of your theme.

The footer_text() function outputs the formatted footer text and accepts three parameters: $before, $after and $default. $before will be outputted _before_ the text, $after will be outputted _after_ the text, and $default will be used instead of the text is none is set. If no text is set $default is empty, nothing will be displayed.

The get_footer_text() function returns the formatted footer text and accepts one parameter: $default, which will be returned if no text is set.

If the plugin isn’t active, the template tag will result in an error. To solve this, you can use an action hook instead:

    do_action( 'footer_text', $default, $before, $after );
    

This works the same as calling the footer_text() function, and any of the three arguments can be omitted.

**Reviews**

Erik September 3, 2016

It still does the trick, even in 4.4!

mojen September 3, 2016

Does exactly what it says on the tin. It works with Insert Pages shortcodes as well. Thank you!

Read all 6 reviews

**Contributors & Developers**

“Footer Text” is open source software. The following people have contributed to this plugin.

Contributors

*    Shea Bunge

**Changelog****2.0.3**

*   Added a message when the text is updated.

**2.0.2**

*   Use a <h1> heading on administration pages

**2.0.1**

*   Update screenshots for WordPress 3.9
*   Add braces to one-line conditionals

**2.0.0**

*   Delete footer text from database on uninstall
*   Added an action as an alternate way to display footer text
*   Restructured code
*   Fixed \[page\_link\] shortcode
*   Added custom ‘edit\_footer\_text’ capability
*   Added support for translations

**1.0.0**

*   Initial release

CVE-2022-27860: Footer Text

WordPress Booking Calendar plugin versions 9.1 and below suffer from PHP object injection and insecure deserialization vulnerabilities.

    On April 18, 2022, the Wordfence Threat Intelligence team initiated the disclosure process for an Object Injection vulnerability in the Booking Calendar plugin for WordPress, which has over 60,000 installations.We received a response the same day and sent over our full disclosure early the next day, on April 19, 2022. A patched version of the plugin, 9.1.1, was released on April 21, 2022.We released a firewall rule to protect Wordfence Premium,  Wordfence Care, and Wordfence Response customers on April 18, 2022. Sites still running the free version of Wordfence will receive the same protection on May 18, 2022.We recommend that all Wordfence users update to the patched version, 9.1.1, as soon as possible as this will entirely eliminate the vulnerability.Description: Insecure Deserialization/PHP Object InjectionAffected Plugin: Booking CalendarPlugin Slug: bookingPlugin Developer: wpdevelop, opluginsAffected Versions: <= 9.1CVE ID: CVE-2022-1463CVSS Score: 8.1(High)CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HResearcher/s: Ramuel GallFully Patched Version: 9.1.1The Booking Calendar plugin allows site owners to add a booking system to their site, which includes the ability to publish a flexible timeline showing existing bookings and openings using a shortcode, [bookingflextimeline].The flexible timeline includes the ability to configure viewing preferences and options when viewing the published timeline. Some of these options were passed in PHP’s serialized data format, and unserialized by the define_request_view_params_from_params function in core/timeline/v2/wpbc-class-timeline_v2.php.An attacker could control the serialized data via several methods:- If a timeline was published, an unauthenticated attacker could obtain the nonce required to send an AJAX request with the action set to WPBC_FLEXTIMELINE_NAV and a timeline_obj[options] parameter set to a serialized PHP object.- Any authenticated attacker could use the built-in parse-media-shortcode AJAX action to execute the [bookingflextimeline] shortcode, adding an options attribute in the shortcode set to a serialized PHP object. This would work even on sites without a published timeline.- An attacker with contributor-level privileges or above could also embed the [bookingflextimeline] shortcode containing a malicious options attribute into a post and execute it by previewing it, or obtain the WPBC_FLEXTIMELINE_NAV nonce by previewing the [bookingflextimeline] shortcode and then using method #1.Any time an attacker can control data that is unserialized by PHP, they can inject a PHP object with properties of their choice. If a “POP Chain” is also present, it can allow an attacker to execute arbitrary code, delete files, or otherwise destroy or gain control of a vulnerable website. Fortunately, no POP chain was present in the Booking plugin, so an attacker would require some luck as well as additional research in order to exploit this vulnerability. Nonetheless, POP chains appear in a number of popular software libraries, so many sites could still be exploited if another plugin using one of these libraries is installed.Despite the lack of a POP chain and complexity involved in exploitation, the potential consequences of a successful attack are so severe that Object Injection vulnerabilities still warrant a “High” CVSS score. We’ve written about Object Injection vulnerabilities in the past (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVpBSr3BkC5gW3zCRq11qNCJPW2qd3df4JnTTpN6klYVQ5js6JV3Zsc37CgG1_W4Cc2TH2cMdlnW5f7ykY58sLPNW4pvZXZ2RXFNBW7KbW7x7z0_PZVDPKzv1yW6N0W7v4Xbb94X562Vx_h734dKwtbW64FBwn4PkBrVW6K_MLr53zwDfW4VH96w95ZT3qW11tQ681xsy7DN1dXl29dh69DW4vpJ0h6nhGVSW5XzPFp40K1RFW5PCymh61jdV9W1WSKs76PKR7rV8vsw54MNkD5W1vSwjN3tdZZ0W6JnYnt1kphDLW5BMKJQ4R6zYYW41XMGF5lxxpWN8_KG5xf57l3VJ9Cpq8kNPCqN90_1c3m4f__W2WnhNh1YPPNGVXZkVx2fCwHNW218B8X4s27wRW8VQWWb9jbvCGVY7B375H-KWTW3DGsJC7yVVSRW2jTqcW3Y3VQ6W7jN8Sg7Y3H67V5dYPX7ZdWPjW74Cb_v3bWjCr3bzH1 ) if you’d like to find out more about how they work.TimelineApril 18, 2022 - We release a firewall rule to protect Wordfence Premium, Care, and Response customers. We initiate the disclosure process. The plugin developer verifies the contact method.April 19, 2022 - We send the full disclosure to the plugin developer.April 21, 2022 - A patched version of the Booking Calendar plugin, 9.1.1, is released.May 18, 2022 - The firewall rule becomes available to free Wordfence users.ConclusionIn today’s post, we covered an Object Injection vulnerability in the Booking Calendar plugin. Wordfence Premium, Wordfence Care, and Wordfence Response customers are fully protected from this vulnerability. Sites running the free version of Wordfence will receive the same protection on May 18, 2022, but have the option of updating the Booking calendar plugin to the patched version 9.1.1 to eliminate the risk immediately.If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance.

WordPress Booking Calendar 9.1 PHP Object Injection / Insecure Deserialization

Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with contributor or higher user rights.

**wp-testing**

**Software**

**Psychological tests & quizzes**

**Vulnerable Versions**

**<= 0.21.19**

**Fixed in version**

**CVE**

**CVE-2021-36867**

**References**

**Credits**

**Classification**

**Cross Site Scripting (XSS)**

**OWASP Top 10**

**A7: Cross-Site Scripting (XSS)**

**Disclosure Date**

**2022-04-26**

**CVSS 3.0 score**

**Requires contributor or higher role user authentication.**

**Plugin does not exist, is not supported or discontinued.**

**Are your websites subject to this vulnerability?**

**Details**

**Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by Ngo Van Thien (Patchstack Alliance) in WordPress Psychological tests & quizzes plugin (versions <= 0.21.19).**

**Solution**

**No patched version.**

**Found a vulnerability that puts your sites at risk?**

**Found a vulnerability? Help us secure the web and join our community of ethical hackers.**

**Are you the developer of this software? Hire our researchers for a thorough security audit.**

CVE-2021-36867: WordPress Psychological tests & quizzes plugin <= 0.21.19 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability - Patchstack

Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with contributor or higher role via &wpt_test_page_submit_button_caption parameter.

*   Details
*   Reviews
*   Support
*   Development

This plugin has been closed as of April 26, 2022 and is not available for download. This closure is temporary, pending a full review.

![](https://secure.gravatar.com/avatar/4b86265be07d2b470a76420fa237b899?s=60&d=retro&r=g)

There is no better plugin than this for this domain.

![](https://secure.gravatar.com/avatar/3652ada8e3ab4497e4960f6d344929e0?s=60&d=retro&r=g)

The plug-in is very good, but there are some incompatibilities. such as Incompatible with the theme's label cloud, resulting in no color display. This is a very powerful WP plug-in I've seen. If the page of submitting results can be displayed, for example; Gender, age, test time and date, that's more perfect

![](https://secure.gravatar.com/avatar/f99995e094d67b5ceeff6b661cc04a5d?s=60&d=retro&r=g)

It works excellent, I would add the possibility of doing mathematical calculations not as conditionals but to obtain numerical results, to do tests that require simple calculations such as: Quality\_of\_life = (anxiety + depression + work) / 2 Then: If: quality\_of\_life> = 5 then: Quality of life: Good

![](https://secure.gravatar.com/avatar/4a8793793a78b222ddaaa69822b40515?s=60&d=retro&r=g)

This is a great plugin I have seen ever, But if getting more updates will be more fantastic

![](https://secure.gravatar.com/avatar/365c3a86e210d343807a9941e85defee?s=60&d=retro&r=g)

I have used this plugin now for several different tests/quizzes - some simple ones and one very complex one with a lot of customization. Works like a dream!

![](https://secure.gravatar.com/avatar/45cb0397d670d0b3fe240cf48b508b2f?s=60&d=retro&r=g)

Does a fantastic job of a complex situation. Is a bit tricky to setup, but allows a number of ways to configure tests/assessments and matched our need very well.

Read all 103 reviews

“Psychological tests & quizzes” is open source software. The following people have contributed to this plugin.

Contributors

CVE-2022-27854: Psychological tests & quizzes

Unauthenticated Cross-Site Scripting (XSS) vulnerability in Tripetto's Tripetto plugin <= 5.1.4 on WordPress via SVG image upload.

CVE-2021-36895: WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto

WordPress Coru LFMember plugin version 1.0.2 suffers from a persistent cross site scripting vulnerability.

    # Exploit Title: WordPress Plugin Coru LFMember - Stored Cross SiteScripting# Date: 26-04-2022# Exploit Author: Mariam Tariq - HunterSherlock# Vendor Homepage: https://wordpress.org/plugins/Coru LFMember/# Version: 1.0.2# Tested on: Firefox# Contact me: mariamtariq404@gmail.com# Vulnerable Code:```<td class="manage-column"><input type="text" value="<?php print$result['game_image'] ?>" name="game_image[]" /></td><td class="manage-column"><?php printstripslashes($result['game_name_short']) ?></td><td class="manage-column"><input type="text" value="<?php printstripslashes($result['game_name_long']) ?>" name="game_name_long[]" /></td><td class="manage-column"><textarea name="game_description[]" rows="4"cols="10"><?php print stripslashes($result['game_description'])?></textarea></td><td class="manage-column"><input type="text" value="<?php print$result['game_link'] ?>" name="game_link[]" /></td>```# POC1. Install the Coru LFMember WordPress plugin and activate it.2. Go to LFMember -> Add New and inject XSS payload “><img src=xonerror=alert(1)> in the fields given i.e, Game Image Name, Game ShortName, Game Long Name, Game Description, and Links to.3. XSS will trigger and will be stored.## POC Imagehttps://imgur.com/kZDtIVz

WordPress Coru LFMember 1.0.2 Cross Site Scripting

WordPress WP-Invoice plugin version 4.3.1 suffers from a persistent cross site scripting vulnerability.

    # Exploit Title: WordPress Plugin  WP-Invoice - Stored Cross Site Scripting# Date: 25-04-2022# Exploit Author: Mariam Tariq - HunterSherlock# Vendor Homepage: https://wordpress.org/plugins/WP-Invoice/# Version: 4.3.1# Tested on: Firefox# Contact me: mariamtariq404@gmail.com# Vulnerable Code:``` wpi.business_name = '<?php echo ($wpi_settings['business_name']); ?>';``# POC1.  Install the WP-Invoice WordPress plugin and activate it.2. Go to WP-Invoice settings  and inside the Business Name field inject XSSpayload “><img src=x onerror=alert(1)>3. XSS will trigger and will be stored.## POC Imagehttps://imgur.com/rsHIEO9

WordPress WP-Invoice 4.3.1 Cross Site Scripting

Plugin Settings Update vulnerability in ShortPixel's ShortPixel Adaptive Images plugin <= 3.3.1 at WordPress allows an attacker with a low user role like a subscriber or higher to change the plugin settings.

Tag

#wordpress