PrePost SEO <= 3.0 - Admin+ Stored Cross-Site Scripting

2023-06-1900:00:00

Taurus Omar

prepost seo

admin

stored

cross-site scripting

xss

exploit

EPSS

0.001

Percentile

40.1%

JSON

The plugin does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

1. Add XSS payload to plugin's "Account API key" setting: "><iframe src="<svg onload=alert(4);>">

2. Save and see XSS exploit.

EPSS

0.001

Percentile

40.1%

JSON

Related for WPEX-ID:4889AD5A-C8C4-4958-B176-64560490497B