WP Brutal AI < 2.06 - Admin+ Stored XSS

2023-07-2400:00:00

Taurus Omar

wordpress

plugin

storedxss

admin

campaign

EPSS

0.001

Percentile

24.0%

JSON

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

In the plugin settings, for a campaign title add the payload:

`><audio src=x onerror=confirm("XSS")>`

Create the campaign and the XSS will be executed.

EPSS

0.001

Percentile

24.0%

JSON

Related for WPEX-ID:62DEB3ED-A7E4-4CDC-A615-CAD2EC2E1E8F