My Site Audit <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS)

2021-07-1900:00:00

Akash Rajendra Patil

330

authenticated cross-site scripting

audit name field

all audit

dashboard

xss exploit

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue

Create an audit with the following payload in the Audit Name field: "><img src onerror=alert(/XSS/)>

Then view the 'All Audit' or 'Dashboard' (of the plugin) pages to trigger the XSS

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:D60634A3-CA39-43BE-893B-FF9BA625360F