PPWP – WordPress Password Protect Page < 1.8.6 - Contributor+ Stored XSS in Shortcode

2023-01-1000:00:00

Lana Codes

wordpress

password protect

xss

shortcode

0.001 Low

EPSS

Percentile

23.3%

JSON

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Exploit shortcode:

[ppwp passwords='pw' class='" onmouseover="alert(1)"']content[/ppwp]

0.001 Low

EPSS

Percentile

23.3%

JSON

Related for WPEX-ID:59C577E9-7D1C-46BC-9218-3E143068738D