WordPress Tabs responsive Plugin 'wp-admin/post.php' HTML Injection Vulnerability

Bugtraq ID:	102648
Class:	Input Validation Error
CVE:	CVE-2018-5312
Remote:	Yes
Local:	No
Published:	Jan 09 2018 12:00AM
Updated:	Jan 09 2018 12:00AM
Credit:	d4wner
Vulnerable:	WordPress Tabs responsive 1.8.0
Not Vulnerable:

WordPress Tabs responsive Plugin 'wp-admin/post.php' HTML Injection Vulnerability

The Tabs-responsive Plugin for WordPress is prone to a HTML injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

tabs-responsive 1.8.0 is vulnerable; other versions may also be affected.

WordPress Tabs responsive Plugin 'wp-admin/post.php' HTML Injection Vulnerability

An attacker can exploit this issue using a web browser.

The following example data is available:

post_title=<script>console.log(/xss/)</script>

WordPress Tabs responsive Plugin 'wp-admin/post.php' HTML Injection Vulnerability

References:

• tabs responsive (wordpress)
  
• WordPress Home Page (wordpress)
  
• Stored-XSS bug (github)
  
• wordpress:stored-xss-bugs-at-the-latest-version-of-tabs-responsive (wordpress)