Lucene search
WordPress WP Brutal AI Cross Site Scripting
WordPress WP Brutal AI - Admin+ Stored XSS vulnerabilit
Show more
| Reporter | Title | Published | Views | Family All 9 |
|---|---|---|---|---|
 | WP Brutal AI < 2.06 - Admin+ Stored XSS | 24 Jul 202300:00 | – | wpexploit |
 | CVE-2023-2606 | 14 Aug 202320:15 | – | nvd |
 | WordPress WP Brutal AI Plugin < 2.06 is vulnerable to Cross Site Scripting (XSS) | 27 Jul 202300:00 | – | patchstack |
 | CVE-2023-2606 WP Brutal AI < 2.06 - Admin+ Stored XSS | 14 Aug 202319:10 | – | vulnrichment |
 | Cross site scripting | 14 Aug 202320:15 | – | prion |
 | WP Brutal AI < 2.06 - Admin+ Stored XSS | 24 Jul 202300:00 | – | wpvulndb |
 | CVE-2023-2606 WP Brutal AI < 2.06 - Admin+ Stored XSS | 14 Aug 202319:10 | – | cvelist |
 | CVE-2023-2606 | 14 Aug 202320:15 | – | cve |
 | Wordfence Intelligence Weekly WordPress Vulnerability Report (July 17, 2023 to July 23, 2023) | 27 Jul 202315:52 | – | wordfence |
`Tittle:
WordPress Plugin WP Brutal AI < 2.06 - Admin+ Stored XSS
References:
CVE-2023-2606
Author:
Taurus Omar
Description:
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Affects Plugins:
WP Brutal AI - Fixed in version 2.06
Proof of Concept:
Visit the following path:
1. Go to Settings » WP Brutal AI
2. Add new campaign
4. Add name payload: "><iframe src="<svg onload=alert(4);>">
3. Save the changes to trigger XSS.
Classification:
Type XSS
OWASP top 10 A7: Cross-Site Scripting (XSS)
CWE-79
wpScan:
https://wpscan.com/vulnerability/62deb3ed-a7e4-4cdc-a615-cad2ec2e1e8f
`
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo25 Jul 2023 00:00Current
7.1High risk
Vulners AI Score7.1
EPSS0.001