

Advisories

Auto Featured Image (Auto Post Thumbnail) - Reflected cross-site scripting (XSS)

Severity pending

Detected by

Fluid Attacks SAST Scanner

Disclosed by

Andres Roldan

Offensive Team, Fluid Attacks

Summary

Full name

Auto Featured Image (Auto Post Thumbnail) 4.1. - Reflected cross-site scripting (XSS)

Code name

skims-28

State

Private

Release date

3 ene 2025

Affected product

Auto Featured Image (Auto Post Thumbnail)

Affected version(s)

Version 4.1.

Vulnerability name

Reflected cross-site scripting (XSS)

Vulnerability type

008. Reflected cross-site scripting (XSS)

Remotely exploitable

CVSS v4.0 vector string

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:U

Exploit available

CVE ID(s)

CVE-2025-0773

Description

Auto Featured Image (Auto Post Thumbnail) 4.1. was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/includes/class-apt.php.

Vulnerability

Skims by Fluid Attacks discovered a Reflected cross-site scripting (XSS) in Auto Featured Image (Auto Post Thumbnail) 4.1.. The following is the output of the tool:

Skims output

 731 |
 732 | erer( 'set_post_thumbnail-' . $post_id );
 733 | T['_ajax_nonce'];
 734 |
 735 | iv class='apt_thumbs' id='wapt_thumbs'>
 736 | <div class='wapt-grid-item'>
 737 | <div class=""wapt-image-box-library""
 738 | data-choose='<?php echo __( 'Choose featured image', 'apt' ); ?>'
 739 | data-update='<?php echo __( 'Select image', 'apt' ); ?>'
 740 | data-postid='<?php echo $post_id; ?>'
> 741 | data-nonce='<?php echo $nonce; ?>'
 742 | style=""background-color: #a3d2ff;"">
 743 | <div class=""wapt-item-generated""><?php echo __( 'Set featured image from medialibrary', 'apt' ); ?></div>
 744 | </div>
 745 | </div>
 746 | div>
   747 |
   748 |
   749 |
   750 |
   751 | PATH . '/admin/views/pro_column.php';
       ^ Col 18

Our security policy

We have reserved the ID CVE-2025-0773 to refer to this issue from now on.

Disclosure policy

System Information

Version: Auto Featured Image (Auto Post Thumbnail) 4.1.

Mitigation

There is currently no patch available for this vulnerability.

Timeline



IA generativa

3 ene 2025



Vendor contacted

3 ene 2025

Inicia tu prueba gratuita de 21 días

Descubre los beneficios de nuestra solución Hacking Continuo, de la que ya disfrutan empresas de todos los tamaños.

Prueba gratis

Contactar a ventas

Inicia tu prueba gratuita de 21 días

Descubre los beneficios de nuestra solución Hacking Continuo, de la que ya disfrutan empresas de todos los tamaños.

Prueba gratis

Contactar a ventas

Inicia tu prueba gratuita de 21 días

Descubre los beneficios de nuestra solución Hacking Continuo, de la que ya disfrutan empresas de todos los tamaños.

Prueba gratis

Contactar a ventas

Solución

Planes

Recursos

Advisories

Compañía

Select Language



Contactar a ventas

Iniciar sesión

Prueba gratis

Select Language



Contactar a ventas

Prueba gratis

Solución

Planes

Recursos

Advisories

Compañía

Select Language



Contactar a ventas

Iniciar sesión

Prueba gratis

Select Language



Las soluciones de Fluid Attacks permiten a las organizaciones identificar, priorizar y remediar vulnerabilidades en su software a lo largo del SDLC. Con el apoyo de la IA, herramientas automatizadas y pentesters, Fluid Attacks acelera la mitigación de la exposición al riesgo de las empresas y fortalece su postura de ciberseguridad.