Lucene search
HistorySep 22, 2021 - 12:00 a.m.
Cookie Bar <= 1.8.8 - Admin+ Stored Cross-Site Scripting
cookie bar
xss
admin
exploit
frontend
vulnerability
EPSS
0.001
Percentile
24.8%
The plugin doesn’t properly sanitise the Cookie Bar Message setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Add the following payload in the "Cookie Bar Message" setting of the plugin (/wp-admin/options-general.php?page=cookie-bar-settings): <img src onerror=alert(/XSS/)>
Then access the frontend (with any user/unauthenticated user) to trigger the XSSRelated
patchstack
patchstack
wpvulndb
wpvulndb
Cookie Bar <= 1.8.8 - Admin+ Stored Cross-Site Scripting
2021-09-22 00:00:00
cvelist
cvelist
CVE-2021-24653 Cookie Bar < 1.8.9 - Admin+ Stored Cross-Site Scripting
2021-10-25 13:20:47
nvd
nvd
CVE-2021-24653
2021-10-25 14:15:10
cve
cve
CVE-2021-24653
2021-10-25 14:15:10
prion
prion
Cross site scripting
2021-10-25 14:15:00