EazyDocs < 2.5.0 - Admin+ Stored XSS

2024-06-1100:00:00

Aditya Vyawahare

eazydocs

admin+

stored xss

update

june 25 2024

6 Medium

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

JSON

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

The PoC will be displayed on June 25, 2024, to give users the time to update.