Business Hours Indicator < 2.3.5 - Authenticated Stored XSS

2021-08-0200:00:00

Asif Nawaz Minhas

336

business hours indicator

authenticated

stored xss

vulnerability

now closed message

setting page

mbhi shortcode

exploit

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not sanitise or escape its 'Now closed message" setting when outputting it in the backend and frontend, leading to an Authenticated Stored Cross-Site Scripting issue

Put the following payload in the "Now closed message" setting and save them: <script>alert(/XSS/)</script>

Then refresh the setting page, or go to a page where the Business Hours are output (tested with the [mbhi ..] shortcode) to trigger the XSS

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:309296D4-C397-4FC7-85FB-A28B5B5B6A8D