Easy Preloader <= 1.0.0 - Authenticated Stored Cross-Site Scripting (XSS)

2021-05-2400:00:00

Kishore Hariram

108

0.001 Low

EPSS

Percentile

22.9%

JSON

The plugin does not sanitise its setting fields, leading to authenticated (admin+) Stored Cross-Site scripting issues

Step 1: Install the plugin "Easy Preloader"

Step 2: Enter the payload below in the text field "Choose overlay color" (or any other text fields) in the plugin's settings (wp-admin/options-general.php?page=ep-options)

"><script>alert(/XSS/)</script>

Step 3: The script will be stored and executed all the times when going to the plugin settings.

0.001 Low

EPSS

Percentile

22.9%

JSON

Related for WPEX-ID:6D6C1D46-5C3D-4D56-9728-2F94064132AA