miniOrange's Google Authenticator < 5.5.6 - Admin+ Stored Cross-Site Scripting

2022-06-0600:00:00

Niraj Mahajan

miniorange google authenticator

stored cross-site scripting

2fa

website security

cross-site scripting

http referer

exploit

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)

Enable 2FA + Website Security and put the following payload in the "Advanced Blocking" tab > "Block HTTP Referer's" section > “Add Referer" field: "><img src=x onerror=alert(/XSS/)>

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:B8784995-0DEB-4C83-959F-52B37881E05C