IgniteUp Admin+ Stored Cross-Site Scripting vulnerability in <= version 3.4.
Reporter | Title | Published | Views | Family All 6 |
---|---|---|---|---|
![]() | Cross site scripting | 9 May 202217:15 | – | prion |
![]() | CVE-2022-0898 | 9 May 202217:15 | – | nvd |
![]() | CVE-2022-0898 | 9 May 202217:15 | – | cve |
![]() | CVE-2022-0898 IgniteUp <= 3.4.1 - Admin+ Stored Cross-Site Scripting | 9 May 202216:50 | – | cvelist |
![]() | WordPress IgniteUp – Coming Soon and Maintenance Mode plugin <= 3.4.1 - Stored Cross-Site Scripting (XSS) vulnerability | 13 Apr 202200:00 | – | patchstack |
![]() | IgniteUp <= 3.4.1 - Admin+ Stored Cross-Site Scripting | 13 Apr 202200:00 | – | wpvulndb |
Customise a template from the plugin (/wp-admin/admin.php?page=cscs_templates) and put the following payload in the Paragraph Text or Descriptive Text field (depending on the template): <script>alert(/XSS/)</script>
XSS will be trigged when previewing, as well as when the "Enable Coming Soon or Site Offline" general option is enabled and the frontend is accessed
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo