Lucene search
Rahul SelvakumarWPVDB-ID:2296156E-B177-478E-A01C-B1EA4FEE0ACAHistoryOct 03, 2022 - 12:00 a.m.
WP Humans.txt <= 1.0.6 - Admin+ Stored Cross-Site Scripting
2022-10-0300:00:00
Rahul Selvakumar
wpscan.com
7
wordpress
plugin
stored cross-site scripting
admin
settings
sanitization
multisite
EPSS
0.001
Percentile
24.8%
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PoC
Put the following payload in the Humans.txt texarea settings of the plugin and save: xss//
Related
cvelist
cvelist
CVE-2022-3392 WP Humans.txt <= 1.0.6 - Admin+ Stored Cross-Site Scripting
2022-10-25 00:00:00
wpexploit
wpexploit
WP Humans.txt <= 1.0.6 - Admin+ Stored Cross-Site Scripting
2022-10-03 00:00:00
nvd
nvd
CVE-2022-3392
2022-10-25 17:15:57
patchstack
patchstack
prion
prion
Cross site scripting
2022-10-25 17:15:00
cve
cve
CVE-2022-3392
2022-10-25 17:15:57