Lucene search
WpvulndbWPEX-ID:271E9469-E746-4B50-BA41-7084218E693DHistoryAug 31, 2020 - 12:00 a.m.
Chamber Dashboard Business Directory < 3.3.1 - Authenticated Stored Cross-Site Scripting
2020-08-3100:00:00
wpvulndb
14
cross-site scripting
authenticated
business directory
dashboard
admin
editor
phone number
payload
business list
country
state
social media
e-mail
city
zip
address
location
hours
EPSS
0.001
Percentile
32.7%
The plugin does not sanitise user input when creating or editing a business in the dashboard, allowing high privilege users (Editor+) to set XSS payloads in various fields.
Login as an editor or admin, then add/edit a business and set the phone number as "><img src onerror=alert(`XSS`)>
The payload will then be executed in the business list dashboard.
Other affected fields: Country, State, Social media url, E-mail, City, Zip, Address, Location and HoursRelated
wpvulndb
wpvulndb
nvd
nvd
CVE-2020-24699
2020-08-31 16:15:15
cve
cve
CVE-2020-24699
2020-08-31 16:15:15
cvelist
cvelist
CVE-2020-24699
2020-08-31 15:29:07
prion
prion
Cross site scripting
2020-08-31 16:15:00
patchstack
patchstack