CVE-2022-3350: Stored Cross-Site Scripting Vulnerability in Contact Bank WordPress Plugin Affecting Versions up to 3..30

A new vulnerability has been identified in the popular Contact Bank WordPress plugin, which allows high privilege users like admin to perform stored Cross-Site Scripting (XSS) attacks when the unfiltered_html capability is disallowed (for example in multisite setups). This can lead to malicious code being executed, posing a threat to the security of the site and its users.

The vulnerability exists due to improper sanitization and escape of some of its Form settings. This issue affects versions up to 3..30 of the Contact Bank plugin. It has been assigned the CVE identifier CVE-2022-3350.

Exploit Details

The issue stems from a lack of proper sanitization and escaping of certain Form settings in the Contact Bank plugin. Specifically, the fields vulnerable to XSS attacks include the form title, description, submit button text, and other form input fields. High privilege users can inject malicious JavaScript code into these fields, which can be stored in the database and executed when the affected form is rendered on the website.

Sample Code Snippet

The following code snippet demonstrates a basic example of injecting malicious JavaScript code into one of the vulnerable fields:

<form action="http://example.com/contact-submit"; method="post">
  <input type="text" name="title" value="<script>alert('XSS');</script>">
  <!-- other form fields -->
  <input type="submit" value="Submit">
</form>

In the snippet above, the JavaScript code <script>alert('XSS');</script> is inserted into the "value" attribute of the form's "title" input field. This would result in the JavaScript code being executed every time the affected form is displayed on the website.

Details about this vulnerability can be found at the following sources

1. CVE-2022-3350 - National Vulnerability Database (NVD)
2. Contact Bank WordPress Plugin through 3..30 - WPScan Vulnerability Database

Mitigation Steps

To mitigate this vulnerability, it is recommended for users to update their Contact Bank WordPress plugin to the latest version (version 3..31 or later) as soon as possible. The plugin developers have addressed this specific vulnerability in the latest version, adding necessary sanitization and escaping of the affected Form fields.

Limiting access to the WordPress admin area to authorized users only

- Regularly monitoring and auditing user activity, especially for high-privileged users, to detect suspicious behavior

Conclusion

The CVE-2022-3350 vulnerability in the Contact Bank WordPress plugin can be a significant threat to website security if left unpatched. It is essential to take the necessary mitigation steps to protect your WordPress site from this stored XSS vulnerability. By updating to the latest version of the plugin and following best practices for WordPress security, you can safeguard your site data and protect the privacy of your users.

Timeline

Published on: 10/25/2022 17:15:00 UTC
Last modified on: 10/26/2022 01:38:00 UTC