Display Post Metadata < 1.5.0 - Contributor+ Stored Cross-Site Scripting

2021-11-1500:00:00

Francesco Carlucci

102

post metadata

contributor+

stored cross-site scripting

custom field

shortcode

previewed page

exploit

EPSS

0.001

Percentile

24.8%

JSON

The plugin adds a shortcode to print out custom fields, however their content is not sanitised or escaped which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks

- Login as contributor+
- Create a custom field containing XSS payload (eg. <script>alert(1)</script>)
- Add this shortcode to the post/page: [metadata element="custom_fields"]
- The XSS will be triggered when the post/page is previewed/viewed by any user

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:49328498-D3A0-4D27-8A52-24054B5E42F3