RPB Chessboard Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the RPB Chessboard WordPress plugin, affecting all versions up to and including 8.1.2. This vulnerability arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into comment content. The injected scripts are executed when users access the affected pages. WordPress's default sanitization does not address this issue, as the malicious payloads can exploit allowed tags and attributes, with the harmful HTML generated at render time by the plugin's comment filter.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the page.

Reproduction

To reproduce this vulnerability, leave a comment on a post using an RPB Chessboard block or shortcode. Include a script payload, such as a link with a title and href, which will be executed when the comment is viewed.

Remediation

Users are advised to update the RPB Chessboard plugin to version 8.1.3 or later.