Collapse-O-Matic <= 1.8.5.5 - Contributor+ Stored XSS

2023-09-2700:00:00

wpvulndb

collapse-o-matic

stored xss

contributor+

shortcode

payload

administrator

exploit

0.0004 Low

EPSS

Percentile

14.1%

JSON

Description The plugin does not validate and escape some parameters, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

As a Contributor user create a new post and add a shortcode containing the following payload:
[expand elwraptag="img src=cx.jpg onmouseover=alert(1);"]test

Now, as an administrator, preview the post and it'll trigger the payload.