PageLayer < 1.8.0 - Author+ Stored XSS

2024-01-0800:00:00

Marc Montpas

author capabilities

post draft

pagelayer

advanced tab

header

body and footer

stored xss

alert prompts

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

14.0%

JSON

Description The plugin doesn’t prevent attackers with administrator privileges from inserting malicious JavaScript inside a post’s header or footer code, even when unfiltered_html is disallowed, such as in multi-site WordPress configurations.

- As a user with Author+ capabilities, create a new post draft
- Save it, then edit it using the PageLayer page builder
- Navigate to the "Advanced" tab, and then the " Header, Body and Footer" section
- Enter `</textarea><script>alert(1);</script>` in the Header, Body and Footer code text areas, and save. 
- Preview the resulting post should make the alert prompts go off.