Simply Excerpts <= 1.4 - Admin+ Stored XSS

2023-11-1300:00:00

niclo

security plugin settings

stored cross-site scripting

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

Description The plugin does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).

Put the following payload in the "Read more text" setting of the plugin and save: 1"><img src=1 onerror=alert(/xss/)>