Lucene search

K
wpexploitShivam RaiWPEX-ID:576CC93D-1499-452B-97DD-80F69002E2A0
HistorySep 29, 2021 - 12:00 a.m.

Modern Events Calendar Lite < 5.22.3 - Authenticated Stored Cross Site Scripting

2021-09-2900:00:00
Shivam Rai
292

0.001 Low

EPSS

Percentile

25.0%

The plugin does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin.

* Go to Setting Tab Under Calendar Lite Plugin
* Under Setting tab Click on Slugs/Permalinks tab
* Enter the XSS payload into Main Slug and Category Slug both. Both fields are vulnerable.
XSS payload used : "><script>alert(1)</script>
* Click On Save Changes. then visit to Setting tab again or reload it. XSS will popup.

0.001 Low

EPSS

Percentile

25.0%

Related for WPEX-ID:576CC93D-1499-452B-97DD-80F69002E2A0