Easy Form Builder < 3.4.0 - Admin+ Stored XSS

2022-11-1600:00:00

Vaibhav Koli

easy form builder

admin+

stored xss

vulnerability

database

javascript

exploit

0.001 Low

EPSS

Percentile

21.2%

JSON

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

1. Navigate to New Form » go to the Settings of the Button and add the payload into the "Text" section: ><img src=x onerror=alert(/XSS/)>

2. You will observe that the payload successfully got stored in the database, and when you are triggering the same functionality in the time JavaScript payload is executing successfully, and we are getting a pop-up.

0.001 Low

EPSS

Percentile

21.2%

JSON

Related for WPEX-ID:FEE8652D-CD50-4CB0-B94D-2D124F56AF1A