WP Server Health Stats < 1.7.0 - Admin+ Stored Cross-Site Scripting

2022-08-2200:00:00

Mika

250

0.001 Low

EPSS

Percentile

24.9%

JSON

The plugin does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

As admin, put the following payload in the "Provide your IP-API Pro key", "Memcached Server Host", "Set the realtime script refresh inverval" or "Memcached Server Port" settings and save: "autofocus onfocus=alert(/XSS/)//

(Note: for settings expecting an integer, change the type=number to type=text with the browser inspector to be able to put the payload)

0.001 Low

EPSS

Percentile

24.9%

JSON

Related for WPEX-ID:237541D5-C1A5-44F2-8E5F-82457B8F9497