Lucene search

K
wpexploitFortune Sam OkonWPEX-ID:DD6EBF6B-209B-437C-9FE4-527AB9E3B9E3
HistoryJul 18, 2022 - 12:00 a.m.

Inspiro Premium < 7.2.3 - Contributor+ Stored Cross-Site Scripting

2022-07-1800:00:00
Fortune Sam Okon
91

0.001 Low

EPSS

Percentile

24.9%

The plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript into the description.

Steps to reproduce:
1) As a Contributor, go to portfolio on the dashboard and add new item.
2) on the editing page that comes up, scroll down to the slider section
3) Add the payload in the description area. "<img src=1 onerror=alert('xss')>"
4) save and preview the item and watch the script trigger.
5)login as an administrator or editor and also preview the created portfolio item and the script gets triggered

0.001 Low

EPSS

Percentile

24.9%

Related for WPEX-ID:DD6EBF6B-209B-437C-9FE4-527AB9E3B9E3