WP Born Babies <= 1.0 - Contributor+ Stored Cross-Site Scripting

2022-05-1600:00:00

Wejdan Alomari

0.001 Low

EPSS

Percentile

24.8%

JSON

The plugin does not sanitise and escape some of its fields, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks

As a contributor, create a new Baby item and put the following payload in any of the settings (such as Birth Date, Time of Birth etc): "><script>alert('XSS')</script>

The XSS will be triggered when editing the post, as well as when viewing/previewing it

0.001 Low

EPSS

Percentile

24.8%

JSON

Related for WPEX-ID:EE4F6786-27E4-474C-85E0-715B0C0F2776