WP Logs Book <= 1.0.1 - Unauthenticated Stored XSS

2024-05-3100:00:00

Bob Matyas

wordpress

unauthenticated

stored xss

admin

exploit

security log

6.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

Description The plugin does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting

1. On the login page, enter any username and for the password enter `<script>alert(1)</script>`
2. As an admin, view the logs at: https://example.com/wp-admin/admin.php?page=wp-logs-book%2Flogin_attack_log and see the XSS