What the vulnerability does
01Description
The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. Because the of the default WordPress validation, it is not possible to insert the payload directly but if the Cooked plugin is installed, it is possible to create a recipe post type (cp_recipe) and inject the payload in the title field. Version 2.0.5 contains a patch for the issue.
Explanation of Vulnerability in Simple Terms
02Summary
Basil versions before 2.0.5 contain a cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject malicious scripts. The vulnerability requires user interaction and can affect other users or components on the site. An attacker with low-level privileges can craft a malicious request that, when visited by another user, executes arbitrary JavaScript in their browser.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that runs in other users' browsers when they visit affected pages.
Potential impact on your site
04Site Impact
Attackers with user accounts can steal session tokens, deface content, or redirect visitors to malicious sites.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account and the victim must visit a page containing the attacker's payload.
Key dates
06Disclosure timeline
July 1, 2024
CVE published
August 2, 2024
Record updated
