CVE-2024-6363

Published June 29th, 2024

View on NVD ↗

CVSS v3

6.4

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock_ticker shortcode in all versions up to, and including, 3.24.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Stock Ticker

A simple and easy configurable plugin for WordPress that allows you to insert a stock ticker with stock price information to posts, pages, widgets, or even to template files. Insertion is enabled by a shortcode or multi-instance widget. Stock data is fetched by the API from <a href="https://www.alphavantage.co/" rel="nofollow ugc">Alpha Vantage</a>. You’ll need an AlphaVantage.co API Key. Stock Ticker is an advanced variation of the <a href="https://wordpress.org/plugins/stock-quote/" rel="ugc">Stock Quote</a> plugin. Multisite WordPress is not supported yet. IMPORTANT: Stock Ticker does not have its Gutenberg Block. You can use Shortcode Block or Common Block to insert the Stock Ticker within the post/page content. <h3>Disclaimer</h3> All stock data used in Stock Ticker is provided by Alpha Vantage, displayed for informational and educational purposes only and should not be considered as investment advice. As of the end of 2023, AlphaVantage limited the Free API tier to 5 requests per minute and 25 requests per day. Before presenting stock data on your website publicly, ensure that you comply with the Alpha Vantage <a href="https://www.alphavantage.co/terms_of_service/" rel="nofollow ugc">Terms of Service</a> and have a valid commercial license! The author of the Stock Ticker plugin does not accept liability or responsibility for your use of the plugin, including but not limited to trading and investment results. Additionally, the author of the Stock Ticker plugin can not guarantee that stock prices are always accurate, as they are provided by a third-party service for free. <h3>Features</h3> <ul> <li>Set a global set of symbols you’ll use site-wide.</li> <li>Configure the default set of stock symbols that will be displayed in the ticker inserted by the empty shortcode.</li> <li>Configure the default presence of the company as Company Name or as a Stock Symbol.</li> <li>Configure colours for unchanged quote, negative and positive changes with the colour picker.</li> <li>Disable scrolling ticker and make it static.</li> <li>Define custom names for companies to be used instead of the symbols.</li> <li>Define custom elements as a part of the visible value.</li> </ul> You can set a custom template for a visible change value. Default format is <code>%company% %price% %change% %changep%</code>. As macro keywords, you can use: <ul> <li><code>%exch_symbol%</code> – Symbol with exchange, like NASDAQ:AAPL</li> <li><code>%symbol%</code> – Company symbol, like AAPL</li> <li><code>%company%</code> – Company name after filtered by custom names, like Apple Inc.</li> <li><code>%price%</code> – Price value, like 125.22</li> <li><code>%change%</code> – Change value, like -5.53</li> <li><code>%changep%</code> – Change percentage, like -4.23%</li> <li><code>%ltrade%</code> – Last trade day (like 2020-09-25), which can be followed by <a href="https://www.php.net/manual/en/datetime.format.php" rel="nofollow ugc">the PHP date format</a> to customise date output, separate by pipe character, eg |l, jS \of F Y</li> </ul> For help, use <a href="https://wordpress.org/support/plugin/stock-ticker/" rel="ugc">the official WordPress support forum</a>. <h3>How To Use</h3> You can add a Stock Ticker to posts, pages or widgets by shortcode or widget (Appearance -> Widgets). <h4>Shortcode</h4> Use the simple shortcode <code>[stock_ticker]</code> without any parameters in a post or page to display the ticker with default settings. You can tweak a single shortcode with parameters: <ul> <li><code>symbols</code> – string with asingle or comma-separated array of stock symbols</li> <li><code>show</code> – a string that defines how the company will be represented on the ticker; can be the <code>name</code> for Company Name, or a <code>symbol</code> for Stock Symbol</li> <li><code>number_format</code> – override default number format for values (default from this settings page used if no custom set by shortcode). Valid options are: <code>cd</code> for 0.000,00; <code>dc</code> for 0,000.00; <code>sd</code> for 0 000.00 and <code>sc</code> for 0 000,00</li> <li><code>decimals</code> – override default number of decimal places for values (default from this settings page used if no custom set by shortcode). Valid values are: <code>1</code>, <code>2</code>, <code>3</code> and <code>4</code></li> <li><code>static</code> – (boolean) to enable static unordered list instead of scrolling ticker, set to <code>1</code> or <code>true</code></li> <li><code>prefill</code> – (boolean) to start with pre-filled instead of an empty ticker set to <code>1</code> or <code>true</code></li> <li><code>duplicate</code> – (boolean) if there are fewer items than visible on the ticker, set this to <code>1</code> or <code>true</code> to make it continuous</li> <li><code>speed</code> – (integer) tune speed of StockTicker block rendered by shortcode</li> <li><code>class</code> – (optional) customise block look and feel, set custom CSS class</li> </ul> <h4>Examples</h4> <ul> <li>Scrolling ticker [stock_ticker symbols=”BABA,EURGBP,LLOY.LON” show=”symbol”]</li> <li>Static unordered list [stock_ticker symbols=”BABA,EURGBP,LLOY.LON” show=”symbol” static=”1″]</li> </ul> <h3>Supported Stock Exchange Markets</h3> Alpha Vantage provide stock data for the following stock exchange markets: <ul> <li>BOM – Bombay Stock Exchange</li> <li>TSE – Canadian/Toronto Securities Exchange</li> <li>FRA – Deutsche Börse Frankfurt Stock Exchange</li> <li>ETR – Deutsche Börse Frankfurt Stock Exchange</li> <li>AMS – Euronext Amsterdam</li> <li>EBR – Euronext Brussels</li> <li>ELI – Euronext Lisbon</li> <li>EPA – Euronext Paris</li> <li>LON – London Stock Exchange</li> <li>NASDAQ – NASDAQ Exchange</li> <li>CPH – NASDAQ OMX Copenhagen</li> <li>HEL – NASDAQ OMX Helsinki</li> <li>ICE – NASDAQ OMX Iceland</li> <li>NYSE – New York Stock Exchange</li> <li>SHA – Shanghai Stock Exchange</li> <li>SHE – Shenzhen Stock Exchange</li> <li>TPE – Taiwan Stock Exchange</li> <li>TYO – Tokyo Stock Exchange</li> </ul> Not supported: <ul> <li>MCX – Moscow Exchange (since December 2018) – eg. <code>MCX:GAZP</code></li> <li>ASX – Australian Securities Exchange (<a href="https://twitter.com/moinzaman/status/1262522914227712000" rel="nofollow ugc">since May 2020</a>) – eg, <code>ASX:MSB</code></li> <li>SGX – Singapore Exchange (<a href="https://kpo-and-czm.blogspot.com/2017/11/bye-yahoo-finance-hi-alpha-vantage.html?showComment=1596075191464#c3946519402226422619" rel="nofollow ugc">since July 13th 2020</a>) – eg, <code>C29.SI</code></li> <li>NSE – National Stock Exchange of India (<a href="https://twitter.com/sachinmankapure/status/1279794312210010114" rel="nofollow ugc">since July 2020</a>) – eg, <code>NSE:VB</code></li> <li>STO – NASDAQ OMX Stockholm (since October 2021) – eg, <code>STO:ATCO-A</code></li> <li>BIT – Borsa Italiana Milan Stock Exchange (<a href="https://wordpress.org/support/topic/bit-not-working/" rel="ugc">since December 2023</a>) – eg, <code>BIT:OLI</code></li> </ul> <h3>Hall of Fame</h3> Kudos to: <ul> <li><a href="https://patchstack.com/database/vulnerability/stock-ticker" rel="nofollow ugc">Patchstack</a> and <a href="https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/stock-ticker" rel="nofollow ugc">Wordfence</a> researchers for early reporting of vulnerabilities.</li> <li>fellow alpha testers <a href="https://wordpress.org/support/users/flexer/" rel="ugc">@flexer</a>, <a href="https://wordpress.org/support/users/khunmax/" rel="ugc">@khunmax</a>, <a href="https://wordpress.org/support/users/k2_1971/" rel="ugc">@k2_1971</a>, and <a href="https://wordpress.org/support/users/vijaleshk/" rel="ugc">@vijaleshk</a>, for release v3.0.0.</li> <li><a href="https://wordpress.org/support/users/eigood/" rel="ugc">@eigood</a>, who pointed me to AlphaVantage.co as an alternative to Google Finance.</li> <li><a href="https://profiles.wordpress.org/rbrodrecht/" rel="nofollow ugc">@rbrodrecht</a> for helping with Alpha Vantage entitlement implementation.</li> </ul>

WordPress Plugin Directory

138K