SendPress Newsletters <= 1.23.11.6 - Admin+ Stored XSS via Settings

2024-03-1800:00:00

Manab Jyoti Dowarah

sendpress newsletters

admin menu

stored xss

settings

advanced

optional settings

read more override

payload

save and reload.

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

1. Click SendPress in the Admin menu (which is available on the left side)
2. Go to the Settings=>Advanced, In the Optional Settings of 'Read More override' paramete add the payload: `"/><img src=x onerror=prompt(document.cookie)>`
3. Save and reload to see XSS.