Current Book <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS)

2021-07-1400:00:00

Vikas Srivastava

111

wordpress 5.7.2

custom book

tools

xss payload

update options

database

javascript payload

popup

security exploit

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not sanitize user input when an authenticated user adds Author or Book Title, then does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting issue.

1. Install WordPress 5.7.2
2. Install and activate Custom Book
3. Navigate to Tools &gt;&gt; Current Book and enter the XSS payload into the
Book and Author input field.
4. Click Update Options
5. You will observe that the payload successfully got stored into the
database and when you are triggering the same functionality at that time
JavaScript payload is executing successfully and we are getting a pop-up.


Screenshot: https://drive.google.com/folderview?id=1KGsxpWmWm8SbCO3aqBG-_A1UJhho2WhU

References

vulners.com/exploitdb/EDB-ID:50127

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:F9911A43-0F4C-403F-9FCA-7822EB693317