Bold Timeline Lite < 1.1.5 - Contributor+ Stored XSS via Shortcode

2023-01-0300:00:00

Lana Codes

155

timeline

xss

stored attack

contributor+

version 1.1.5

EPSS

0.001

Percentile

25.5%

JSON

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Exploit shortcode:

[bold_timeline_item_text el_class='" onmouseover="alert(1)" style="background:red;width:100px;height:100px;"']

EPSS

0.001

Percentile

25.5%

JSON

Related for WPEX-ID:06E1D63E-576B-4E16-BEB7-4F0BFB85E948