QR Redirector < 1.6.1 - Contributor+ Stored Cross-Site Scripting

2021-10-1800:00:00

apple502j

268

contributor+ stored cross-site scripting

url redirection

admin notes

exploit

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not sanitise and escape some of the QR Redirect fields, which could allow users with a role as low as Contributor perform Stored Cross-Site Scripting attacks.

As a contributor, create/edit a "QR Redirect" and set the following fields:

"URL to Redirect to": https://example.com/#" style="animation-name:rotation" onanimationend="alert(/XSS-URL/)//
"Admin Notes": </textarea><script>alert(/XSS-admin-notes/)</script>

The XSS will be triggered when any user access the QR Redirect (for example an admin reviewing it)

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:0D422397-69FF-4D05-AAFA-7A572E460E5F