Storefront Footer Text <= 1.0.1 - Admin+ Stored Cross-Site Scripting

2021-10-1100:00:00

Asif Nawaz Minhas

285

storefront

cross-site scripting

admin panel

stored xss

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not sanitize and escape the “Footer Credit Text” added to pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed.

(The plugin requires the Storefront theme)

Go to Appearance > Customize (/wp-admin/customize.php), open the Footer customisation and put the following payload in the Footer Credit Text: <script>alert(/XSS/)</script>

The XSS will be triggered in all frontend pages, and Customise admin panel as well

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:EFA7D91A-447B-4FD8-AA21-5364B177FEE9