Easy Forms for MailChimp < 6.8.9 - Admin+ Stored XSS

2023-03-0900:00:00

Chau Nguyen

mailchimp easy forms

stored xss

admin

exploit

vulnerability

0.0005 Low

EPSS

Percentile

18.3%

JSON

The plugin does not sanitise and escape some of its from parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Edit a form and put the following payload in the Form Name: "><script>alert(/XSS/)</script>

The XSS will be triggered when viewing the form list (/wp-admin/admin.php?page=yikes-inc-easy-mailchimp) (<= 6.8.8), as well on page/post where the form is embed (via the shortcode) (< 6.8.7)

0.0005 Low

EPSS

Percentile

18.3%

JSON

Related for WPEX-ID:D3A2AF00-719C-4B86-8877-B1D68A589192