Mortgage Calculators WP < 1.56 - Admin+ Stored Cross-Site Scripting

2022-01-1100:00:00

Ceylan Bozogullarindan

mortgage calculators

cross-site scripting

admin

settings

payload

shortcode

exploit

EPSS

0.001

Percentile

38.3%

JSON

The plugin does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

1. Go to settings page available under the "Calculator" menu item.
2. Click the "Select Color" button and type the following payload the input space: </style></head><script>alert(/XSS/)</script>
3. Click the "Save Changes" button to save settings.
4. Create a new page and add the shortcode ([mcwp type="cv"]) of the calculator, for testing.
5. Visit the page to trigger XSS.

EPSS

0.001

Percentile

38.3%

JSON

Related for WPEX-ID:7B80F89B-E724-41C5-AA03-21D1EEF50F21