weForms < 1.6.14 - Admin+ Stored Cross-Site Scripting

2022-07-1200:00:00

Tri Wanda Septian

154

0.001 Low

EPSS

Percentile

25.0%

JSON

The plugin does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

On the dashboard navigate to weForms > All Forms > Add Form > Choose Contact Form;
Click Create Form >  Settings
Inject with cross-site scripting (xss) payload: <img src=x onerror=alert(document.cookie);> on Message to Show form.
Save Form
On the post/page containing the form, fill up the contact form and submit it to trigger the payload

0.001 Low

EPSS

Percentile

25.0%

JSON

Related for WPEX-ID:5E442DD9-A49D-4A8E-959B-199A8689DA4B