What the vulnerability does
01Description
A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function render of the file panels/class-debug-bar-queries.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.8.1 is able to address this issue. The patch is named 0842af8f8a556bc3e39b9ef758173b0a8a9ccbfc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222739.
Explanation of Vulnerability in Simple Terms
02Summary
The Debug Bar Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions before 0.1. An authenticated user with low privileges can inject malicious scripts that execute in the browsers of other site users who view the debug bar output. The vulnerability requires user interaction to trigger but can compromise site security and user data.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers when they view debug bar output.
Potential impact on your site
04Site Impact
Authenticated users can inject scripts affecting other site visitors, potentially stealing credentials or modifying site content in their browsers.
Conditions required to exploit
05Prerequisites
Attacker must be logged in with low-level privileges; victim must view a page containing the injected debug bar content.
Key dates
06Disclosure timeline
March 11, 2023
CVE published
August 6, 2024
Record updated
