Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
wpexploitFayçal CHENAWPEX-ID:7800D583-FCFC-4360-9DC3-AF3F73E12AB4
HistoryMay 26, 2022 - 12:00 a.m.

Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS

2022-05-2600:00:00
Fayçal CHENA
76

0.001 Low

EPSS

Percentile

24.8%

JSON

The plugin does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Create a new Grid/Caroussel, in the General Settings, enable "Display Header Title" and put the following payload in the "Header Title" field: <svg onload=alert(/XSS/)>

The XSS will be triggered when viewing the Post Grid/Carousel in the post.

Related

cvelist 1
patchstack 1
nvd 1
wpvulndb 1
prion 1
cnvd 1
cve 1
cvelist
cvelist
CVE-2022-1266 Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS
2022-06-20 10:25:48
patchstack
patchstack
WordPress Post Grid, Slider & Carousel Ultimate plugin <= 1.4.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
2022-05-26 00:00:00
nvd
nvd
CVE-2022-1266
2022-06-20 11:15:09
wpvulndb
wpvulndb
Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS
2022-05-26 00:00:00
prion
prion
Cross site scripting
2022-06-20 11:15:00
cnvd
cnvd
WordPress Post Grid,Slider
2022-06-22 00:00:00
cve
cve
CVE-2022-1266
2022-06-20 11:15:09

0.001 Low

EPSS

Percentile

24.8%

JSON
Related for WPEX-ID:7800D583-FCFC-4360-9DC3-AF3F73E12AB4
cvelist1patchstack1nvd1wpvulndb1prion1cnvd1cve1