Lucene search

K

IgniteUp <= 3.4.1 - Admin+ Stored Cross-Site Scripting

🗓️ 13 Apr 2022 00:00:00Reported by Kaushalendra DubeyType 
wpexploit
 wpexploit
👁 93 Views

IgniteUp Admin+ Stored Cross-Site Scripting vulnerability in <= version 3.4.

Show more
Related
Code
Customise a template from the plugin (/wp-admin/admin.php?page=cscs_templates) and put the following payload in the Paragraph Text or Descriptive Text field (depending on the template): <script>alert(/XSS/)</script>

XSS will be trigged when previewing, as well as when the "Enable Coming Soon or Site Offline" general option is enabled and the frontend is accessed

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo