WP Socializer < 7.3 - Admin+ Stored Cross-Site Scripting

2022-09-0600:00:00

wpvulndb

112

wp socializer

cross-site scripting

share icons

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not sanitise and escape some of its Icons settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Activate the Share Icons feature of the plugin, edit one of the Icon settings and put the following payload in the "Text to show next to icon" field: <img src onerror=alert(/XSS/)> 

Save the icon settings, and then the Share Icon settings. The XSS will be triggered in all frontend posts

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:36A7B872-31FA-4375-9BE7-8F787E616ED5