Lucene search

Sachin Bahl from eSec Forte Technologies Pvt LtdWPEX-ID:A11628E4-F47B-42D8-9C09-7536D49FCE4C

HistoryJun 20, 2022 - 12:00 a.m.

WP Duplicate Page < 1.3 - Admin+ Stored Cross Site Scripting

2022-06-2000:00:00

Sachin Bahl from eSec Forte Technologies Pvt Ltd

settings

duplicate page

xss

payload

database

javascript

exploit

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.

1. Navigate to Settings ->Duplicate Page -> Duplicate Page Settings and enter the XSS payload into
the Duplicate Page Link Text input field.
2. Click Save Changes.
3. You will observe that the payload successfully got stored into the
database and when you are triggering the same functionality at that time
JavaScript payload is executing successfully and we are getting a pop-up.
4. Payload Used: "onmouseover=alert(/XSS/)//

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:A11628E4-F47B-42D8-9C09-7536D49FCE4C