Lucene search
WpvulndbWPEX-ID:7C448F6D-4531-4757-BFF0-BE9E3220BBBBHistoryJun 25, 2024 - 12:00 a.m.
WordPress < 6.5.5 - Contributor+ Stored XSS in Template-Part Block
2024-06-2500:00:00
wpvulndb
94
wordpress
stored xss
template-part block
contributor
exploit
6 Medium
AI Score
Confidence
High
Description WordPress does not properly escape the “tagName” attribute in the “Template Part block” allowing high-privileged users to perform Stored Cross-Site Scripting (XSS) attacks.
As a contributor, add a "Template Part" block to a post, click on "Start Blank" and then Create.
Go into Editor mode and add the following to the wp:template-part block: "tagName":"img src=x onerror=alert(1) title=x"6 Medium
AI Score
Confidence
High