Lucene search
Asif Nawaz MinhasWPEX-ID:E2AF8C7F-9BD4-4902-8DF8-72FFB414FDBFHistoryNov 02, 2022 - 12:00 a.m.
Salat Times < 3.2.2 - Admin+ Stored Cross-Site Scripting
2022-11-0200:00:00
Asif Nawaz Minhas
53
salat times
settings
cross-site scripting
stored
exploit
0.001 Low
EPSS
Percentile
25.0%
The plugin does not sanitize and escapes its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Put the following payload in any text field of Settings > Salat Times: "><img src onerror=alert(/XSS/)>
Save, and the XSS will be triggered when accessing the settings again.
The payload will also be triggered in pages where the [daily_salat_times] is embedded.Related
prion
prion
Cross site scripting
2022-11-28 14:15:00
nvd
nvd
CVE-2022-2983
2022-11-28 14:15:11
wpvulndb
wpvulndb
Salat Times < 3.2.2 - Admin+ Stored Cross-Site Scripting
2022-11-02 00:00:00
patchstack
patchstack
cve
cve
CVE-2022-2983
2022-11-28 14:15:11
cvelist
cvelist
CVE-2022-2983 Salat Times < 3.2.2 - Admin+ Stored Cross-Site Scripting
2022-11-28 13:47:14