CVE-2023-3169

MEDIUMNuclei

tagDiv Composer < 4.2 - Unauthenticated Stored XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-3169 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 19, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 26, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

tagDiv Composer

Default status: unaffected

CVE ListBefore 4.2affected

tagdiv_composer

Browse tagdiv / tagdiv_composer

Default status: unknown

CVE List, VulnCheckBefore 4.2affected

Nuclei templates

1
ProjectDiscoveryHIGHtagDiv Composer < 4.2 - Stored Cross-Site ScriptingCVSS 6.1

tagDiv Composer plugin versions before 4.2 for WordPress are vulnerable to unauthenticated stored XSS via the /wp-json/tdw/save_css endpoint. An attacker can inject malicious JavaScript code through the compiled_css parameter, which gets stored and executed when the CSS is loaded.

Impact

Unauthenticated attackers can inject malicious JavaScript through the compiled_css parameter which gets stored and executed when the CSS is loaded, potentially compromising all visitors to the WordPress site.

Remediation

Update tagDiv Composer plugin to version 4.2 or later that properly validates and sanitizes CSS input from the save_css endpoint and requires authentication.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2023wordpresswp-pluginwpxsstd-composertagdivintrusivevkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:tagdiv:tagdiv_composer:*:*:*:*:*:wordpress:*:*
FOFA: body="/wp-content/plugins/td-composer"
https://wpscan.com/vulnerability/e6d8216d-ace4-48ba-afca-74da0dc5abb5 https://nvd.nist.gov/vuln/detail/CVE-2023-3169

Source: ProjectDiscovery

References

2