Pet Manager <= 1.4 - Contributor+ Stored XSS

2024-05-0200:00:00

Bob Matyas

pet manager

stored xss

contributor+

poc

may 16 2024

update

5.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not sanitise and escape some of its Pet settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting attacks.

1. Go to "Pets > Add Pet"
2. In the "Address" field add the payload `" style=animation-name:rotation onanimationstart=alert(/XSS/)//`
3. Save and reload to see the XSS