BannerMan <= 0.2.4 - Multiple Admin+ Stored Cross-Site Scripting

2022-05-0900:00:00

Fayçal CHENA

bannerman plugin

cross-site scripting

admin

exploit

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not sanitize or escape its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed (such as in multisite)

As administrator, put the following payloads in the mentioned settings of the plugin (/wp-admin/options-general.php?page=bannerman) then save

- </textarea><svg/onload=prompt(/XSS/)> in any of the textarea fields, like "Style your banner with CSS:"
- "><script>alert(/XSS/)</script> in any of the text fields like "Background colour"

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:BC2E5BE3-CD2B-4EE9-8D7A-CABCE46B7092