tagDiv Composer < 4.2 - Admin+ Stored XSS

2023-08-1700:00:00

Truoc Phan

tagdiv composer

newsmag

admin+

stored xss

custom css

exploit

EPSS

0.001

Percentile

24.0%

JSON

Description The plugin, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

1. Visit Newsmag > Plugins and install and activate "tagDiv Composer"
2. Visit Newsmag > Theme panel > Custom Code
3. Enter the following in "Custom CSS" and click "Save Settings":

</style><img src onerror=alert('XSS')><style>

4. Visit the site frontend to see the XSS.

EPSS

0.001

Percentile

24.0%

JSON

Related for WPEX-ID:E95FF3C6-283B-4E5E-BEA0-1F1375DA08DA