Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in 3D Tag Cloud plugin <= 3.8 at WordPress.

*   Details
*   Reviews
*   Support
*   Development

This plugin has been closed as of September 22, 2022 and is not available for download. This closure is temporary, pending a full review.

I have been using this plugin for years now--beginning with PHP 5.6.X, and currently running under WP v5.9.X and PHP 7.4.X. I have also done a local Laragon dev under PHP 8.1.X and it still rolls on! It is completely configurable to mimic the CSS of your theme--and while is a bit of useful fluff--it certainly adds charm to a WP site.

The use of 'wp\_head' hook to inject javascript code that requires jQuery may fail. I changed it to 'wp\_footer' Calling jQuery.noConflict() also makes other parts of the website that use $ to call jQuery fail. It is really unnecessary to call .noConflict() so I recommend removing it.

I Like it. Actually, it made me clean up my tag DB just to be able to use it 🙂

The new version of this plugin avails the options under the Settings Menu under 3D Tag Cloud. A quick update of the settings and adding a few quick tags to the posts gave me a nice addition to alternative prism view of my site. I love it. I use in on GiantLeap.com for now and will add to others I am sure.

in the new Version this Plugin is full OK. I say Thank you for this Plugin, i use this on my Site.

Great idea, but not customizable with no options for colours, different tags, and locations (i.e. sidebar, bottom, etc). It seems to also have a bug that remains on different pages.

Read all 23 reviews

“3D Tag Cloud” is open source software. The following people have contributed to this plugin.

Contributors

*    Vinoj Cardoza

CVE-2022-36417: 3D Tag Cloud

Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in Tabs plugin <= 3.7.1 at WordPress.

CVE-2022-40215

Jessica Haworth 23 September 2022 at 16:01 UTC

Issue has since been fixed

  

A vulnerability in Netlify could allow an attacker to achieve either persistent cross-site scripting (XSS) or full-response server-side request forgery on any supported website.

Netlify is a web development platform that also offers hosting and serverless backend services for websites.

Researchers found that Netlify was open to XSS attacks due to a cache poisoning vulnerability.

Read more of the latest web security vulnerability news

The security flaw, tracked as CVE-2022-39239, allowed an attacker to bypass the source image domain allowlist by sending specially crafted headers, causing the handler to load and return arbitrary images.

Because the response is cached globally, the image would then be served to visitors without requiring those headers to be set.

Therefore, an attacker could achieve XSS by requesting a malicious SVG file with embedded scripts, which would then be served from the site domain.

The GitHub advisory explains: “Note that this does not apply to images loaded in tags, as scripts do not execute in this context.

It adds: “The image URL can be set in the header independently of the request URL, meaning any site images that have not previously been cached can have their cache poisoned.”

**URL parsing peril**

A blog post by Sam Curry, one of the researchers involved in the discovery, explained that the bug affected multiple websites including Gemini, PancakeSwap, Docusign, Moonpay, and Celo.

Curry wrote: “It is possible to achieve cross-site scripting and server-side request forgery on any website running the “” library if the developers have added a whitelisted host to the configuration file due to improper URL parsing in the “” library.

“This could be abused on a large number of websites as the “” route is installed \[by default\] on many Netlify installations.”

The issue was reported on August 24, 2022, and patched two days later in version 1.2.3.

“The problem is no longer exploitable on Netlify as the CDN \[content delivery network\] now sanitizes the relevant header. Cached content can be cleared by re-deploying the site,” the advisory reads.

More technical detail can be found in Curry’s write up.

The Daily Swig has reached out to Curry for further comment and will update this article accordingly.

YOU MAY ALSO LIKE Tarfile path traversal bug from 2007 still present in 350k open source repos

Netlify vulnerable to XSS, SSRF attacks via cache poisoning

Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NOTICE BOARD plugin <= 1.1 at WordPress.

CVE-2022-38460

Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability Add Shortcodes Actions And Filters plugin <= 2.0.9 at WordPress.

CVE-2022-37342

Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CPO Shortcodes plugin <= 1.5.0 at WordPress.

CVE-2022-40672

WordPress 3dady Real-Time Web Stats plugin version 1.0 suffers from a persistent cross site scripting vulnerability.

    # Exploit Title: Wordpress Plugin 3dady real-time web stats 1.0 - Stored Cross Site Scripting (XSS)# Google Dork: inurl:/wp-content/plugins/3dady-real-time-web-stats/# Date: 2022-08-24# Exploit Author: UnD3sc0n0c1d0# Vendor Homepage: https://profiles.wordpress.org/3dady/# Software Link: https://downloads.wordpress.org/plugin/3dady-real-time-web-stats.zip# Category: Web Application# Version: 1.0# Tested on: Debian / WordPress 6.0.1# CVE : N/A# 1. Technical Description:The 3dady real-time web stats WordPress plugin is vulnerable to stored XSS. Specifically in the dady_input_text and dady2_input_text fields because the user's input is not properly sanitized which allows the insertion of JavaScript code that can exploit the vulnerability.  # 2. Proof of Concept (PoC):  a. Install and activate version 1.0 of the plugin.  b. Go to the plugin options panel (http://[TARGET]/wp-admin/admin.php?page=3dady).  c. Insert the following payload in any of the visible fields (dady_input_text or dady2_input_text):    " autofocus onfocus=alert(/XSS/)>  d. Save the changes and immediately the popup window demonstrating the vulnerability (PoC) will be executed.  Note: This change will be permanent until you modify the edited fields.

WordPress 3dady Real-Time Web Stats 1.0 Cross Site Scripting

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title & Description values that can be added to an Image Hover in versions up to, and including, 9.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.

CVE-2022-2937: Vulnerability Advisories - Wordfence

WordPress WP-UserOnline plugin version 2.88.0 suffers from a persistent cross site scripting vulnerability.

    # Exploit Title: Wordpress Plugin WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS)# Google Dork: inurl:/wp-content/plugins/wp-useronline/# Date: 2022-08-24# Exploit Author: UnD3sc0n0c1d0# Vendor Homepage: https://github.com/lesterchan/wp-useronline# Software Link: https://downloads.wordpress.org/plugin/wp-useronline.2.88.0.zip# Category: Web Application# Version: 2.88.0# Tested on: Debian / WordPress 6.0.1# CVE : CVE-2022-2941# Reference: https://github.com/lesterchan/wp-useronline/commit/59c76b20e4e27489f93dee4ef1254d6204e08b3c# 1. Technical Description:The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the “Naming Conventions” section do not properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user accesses the injected page.  # 2. Proof of Concept (PoC):  a. Install and activate version 2.88.0 of the plugin.  b. Go to the plugin options panel (http://[TARGET]/wp-admin/options-general.php?page=useronline-settings).  c. Identify the "Naming Conventions" section and type your payload in any of the existing fields. You can use     the following payload:    <script>alert(/XSS/)</script>  d. Save the changes and now go to the Dashboard/WP-UserOnline option. As soon as you click here, your payload      will be executed.Note: This change will be permanent until you modify the edited fields.

WordPress WP-UserOnline 2.88.0 Cross Site Scripting

Testa Online Test Management System version 3.5.1 suffers from a cross site scripting vulnerability.

    # Exploit Title: Testa 3.5.1 Online Test Management System - Reflected Cross-Site Scripting (XSS)# Date: 28/08/2022# Exploit Author: Ashkan Moghaddas# Vendor Homepage: https://testa.cc# Software Link: https://download.aftab.cc/products/testa/Testa_wos_2.0.1.zip# Version: 3.5.1# Tested on: Windows/Linux# Proof of Concept:# 1- Install Testa 3.5.1# 2- Go to https://localhost.com/login.php?redirect=XXXX# 3- Add payload to the Tab, the XSS Payload: %22%3E%3Cscript%3Ealert(%22Ultraamooz.com%22)%3C/script%3E# 4- XSS has been triggered.# Go to this url "https://localhost.com/login.php?redirect=%22%3E%3Cscript%3Ealert(%22Ultraamooz.com%22)%3C/script%3E"XSS will trigger.

Tag

#xss