Lucene search
Ma LongWPEX-ID:5ACD231B-4072-4EE1-9497-023465318608HistoryJan 23, 2024 - 12:00 a.m.
WolfNet IDX for WordPress <= 1.19.1 - Admin+ Stored XSS
2024-01-2300:00:00
Ma Long
42
wolfnet idx
wordpress
version 1.19.1
admin
stored xss
settings
product key
save changes
exploit
security
7.9 High
AI Score
Confidence
High
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
1. In the settings of the plugin, enter the following value in "Product Key". The value is: `"><svg/onload=alert('xss')>`
2. Click the 'Save Changes' button on the page.
3. Refresh or re-enter the page and move the mouse over the input box to get the XSS trigger.Related
wpvulndb
wpvulndb
WolfNet IDX for WordPress <= 1.19.1 - Admin+ Stored XSS
2024-01-23 00:00:00
wordfence
wordfence