In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use, we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports, we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular, are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to the level of getting their own post, we now place them in a weekly post when we come across them.

Admin+ Stored Cross-Site Scripting in Easy Smooth Scroll Links

A claimed admin+ stored cross-site scripting vulnerability in Easy Smooth Scroll Links is described this way:

The plugin does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

To access the plugin’s settings, the user has to be logged in as an Administrator:

110

add_options_page( ESSLPluginOptions_NICK . ' Plugin Options', 'Easy Smooth Scroll Links', 'manage_options', ESSLPluginOptions_ID . '_options', array(

If an attacker is logged in as an Administrator they can do basically whatever they want, including usually allowing the unfiltered_html capability, so this really wouldn’t be a vulnerability.

This false report was given a CVE id by WPScan, CVE-2022-0728, despite not really being a vulnerability.

Persistent Cross Site Scripting in Curtain

With a claimed persistent cross-site scripting vulnerability in Curtain, the proof of concept starts with these steps:

1- Login to your WordPress Application
2- Install curtain plugin
3- Open the page
http://wordpressURL/wp-admin/options-general.php?page=curtain

To access that page, the plugin’s settings page, the user has to be logged in as an Administrator:

380

add_options_page( $title, $title, 'manage_options', 'curtain', array( $this, 'load_options' ) );

If an attacker is logged in as an Administrator they can do basically whatever they want, so this really wouldn’t be a vulnerability.