RSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSS

2023-01-0400:00:00

Lana Codes

rss aggregator

feedzy

xss

stored

block

css class

payload

0.001 Low

EPSS

Percentile

23.5%

JSON

The plugin does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

1. Add the Feedzy RSS Feeds Block.

2. Then add the CSS Class to the Block: " onmouseover="alert(1)" style="background:red;"

3. Hover the mouse over the content displayed by the block in a page/post to trigger the payload.

0.001 Low

EPSS

Percentile

23.5%

JSON

Related for WPEX-ID:A388232B-A399-46A5-83E6-20C1B5DF351D