Spectra < 1.15.0 - Contributor+ Stored Cross-Side Scripting

2023-01-2400:00:00

Lana Codes

172

spectra 1.15.0 cross-site scripting contact form 7 styler block exploit_css class_alert background red

EPSS

0.001

Percentile

25.5%

JSON

The plugin does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS attacks via the plugin’s Gutenberg blocks.

Note: The exploit requires the Contact Form 7 plugin.

Exploit Additional CSS class(es) for “Contact Form 7 Styler” Gutenberg block:
" onmouseover="alert(1)" style="background:red;"

EPSS

0.001

Percentile

25.5%

JSON

Related for WPEX-ID:10F7E892-7A91-4292-B03E-6AD75756488B