Lucene search
Dmitrii IgnatyevWPEX-ID:194EBF81-8FE4-4C74-8174-35D0AC00AC93HistoryMar 26, 2024 - 12:00 a.m.
My Sticky Bar < 2.6.8 - Admin+ Stored XSS
2024-03-2600:00:00
Dmitrii Ignatyev
62
sticky bar
admin+
stored xss
5.7 Medium
AI Score
Confidence
High
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
You should click on "My Sticky Bar" and create "New Bar". Change mysticky_option_welcomebar.5Bmysticky_welcomebar_x_color%5D field to %23000000"onmouseover=alert(1)// -> Save Settings