Form - Contact Form <= 1.2.4 - Admin+ Stored Cross-Site Scripting

2022-06-0300:00:00

Fayçal CHENA

107

form

contact

admin

stored

cross-site scripting

exploit

payload

field

embed

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not sanitize and escape Custom text fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Create/edit a form, add a Custom Text field, put the following payload in it: <script>alert(/XSS/)</script>, save the field and update the form

The XSS will be triggered in page/post where the form is embed

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:F57615D9-A567-4C2A-9F06-2C6B61F56074