Lucene search
Muhamad hidayatWPVDB-ID:27AD58BA-B648-41D9-8074-16E4FEEAEE69HistoryApr 11, 2022 - 12:00 a.m.
Adrotate < 5.8.23 - Admin+ XSS via Advert Name
2022-04-1100:00:00
muhamad hidayat
wpscan.com
15
0.001 Low
EPSS
Percentile
24.9%
The plugin does not sanitise and escape Advert Names which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
PoC
Create/edit an Advert and put the following payload in the Name field: "> The XSS will be triggered when accessing the Manage Adverts page
Related
prion
prion
Cross site scripting
2022-05-02 16:15:00
cve
cve
CVE-2022-0662
2022-05-02 16:15:08
wpexploit
wpexploit
Adrotate < 5.8.23 - Admin+ XSS via Advert Name
2022-04-11 00:00:00
cnvd
cnvd
WordPress AdRotate plugin cross-site scripting vulnerability
2022-05-07 00:00:00
cvelist
cvelist
CVE-2022-0662 Adrotate < 5.8.23 - Admin+ XSS via Advert Name
2022-05-02 16:05:40
nvd
nvd
CVE-2022-0662
2022-05-02 16:15:08
patchstack
patchstack