WordPress Car Rental System 1.3 Cross Site Scripting

`# Exploit Title: WordPress Car Rental System 1.3 XSS Vunlerability  
# Google Dork:N/A  
# Date: 2020-04-04  
# Exploit Author: @ThelastVvV  
# Vendor Homepage: https://codecanyon.net/item/car-rental-system-wordpress-plugin/4239755?s_rank=3  
# Version: 1.3  
# Tested on: 5.4.0-kali4-amd64  
  
---------------------------------------------------------  
  
  
Summary:  
  
Persistent Cross-site Scripting in Customer registration-form all-tags   
  
PoC 1:  
  
  
  
1- Go to the car renting page then choose new customor   
http://example/wp-car/  
  
2- In "any " field of registration form type your payload :  
"><img src=x onerror=prompt(document.domain);>  
  
3-then hit CONTINUE  
  
  
4- Once the admin logs in and go to Booking list or customer lookup page ... the admin will be xssed   
  
  
http://example/wp-car/wp-admin/admin.php?page=booking-list  
or   
http://example/wp-car/wp-admin/admin.php?page=cust-lookup  
  
  
  
  
Impact:  
XSS can lead to adminstators/users's Session Hijacking, and if used in conjunction with a social engineering attack it can also lead to disclosure of sensitive data, CSRF attacks and other critical attacks on administrators directly.  
  
  
Other infos:  
  
Supported Wordpress versions:  
WordPress 4.9.x  
WordPress 4.8.x  
WordPress 4.7.x  
WordPress 4.6.1  
WordPress 4.6  
WordPress 4.5.x  
WordPress 4.5.2  
WordPress 4.5.1   
WordPress 4.5   
WordPress 4.4.2   
WordPress 4.4.1   
WordPress 4.4   
WordPress 4.3.1   
WordPress 4.3,   
WordPress 4.2,   
WordPress 4.1,   
wordPress 4.0  
  
Screentshoots:  
  
https://imgur.com/5Mt5sR0  
https://imgur.com/xyd4dur  
  
`