ArForms < 6.6 - Admin+ Stored XSS

2024-05-1700:00:00

Bob Matyas

arforms

stored cross-site scripting

poc

may 31 2024

users

update

admin+

7.9 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

1. Add or edit an existing form and in the Custom CSS, enter the payload:
`"p {color: red;}</style> <script>alert(2)</script><style>`
2. Save
3. Reload and see the XSS