Lucene search
TYMWPVDB-ID:04EAF380-C345-425F-8800-142E3F4745A9HistoryAug 10, 2021 - 12:00 a.m.
AddToAny Share Buttons < 1.7.48 - Admin+ Stored Cross-Site Scripting
2021-08-1000:00:00
TYM
wpscan.com
10
0.001 Low
EPSS
Percentile
21.5%
The plugin does not escape its Image URL button setting, which could lead allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PoC
Add the following payload in the Universal Button > Image URL settings: " onerror=alert(/XSS/) " The XSS will be triggered in all frontend posts
| CPE | Name | Operator | Version |
|---|---|---|---|
| add-to-any | lt | 1.7.48 |
Related
nvd
nvd
CVE-2021-24616
2021-11-08 18:15:08
cve
cve
CVE-2021-24616
2021-11-08 18:15:08
patchstack
patchstack
openvas
openvas
WordPress AddToAny Share Buttons Plugin < 1.7.48 XSS Vulnerability
2021-11-16 00:00:00
cnvd
cnvd
WordPress AddToAny Share Buttons plugin cross-site scripting vulnerability
2021-11-10 00:00:00
cvelist
cvelist
prion
prion
Cross site scripting
2021-11-08 18:15:00
wpexploit
wpexploit
AddToAny Share Buttons < 1.7.48 - Admin+ Stored Cross-Site Scripting
2021-08-10 00:00:00