Lucene search
Mansi SinghWPVDB-ID:2BDE2030-2DFE-4DD3-AFC1-36F7031A91EAHistoryNov 29, 2021 - 12:00 a.m.
Typebot < 1.4.3 - Admin+ Stored Cross Site Scripting
2021-11-2900:00:00
Mansi Singh
wpscan.com
9
0.001 Low
EPSS
Percentile
24.8%
The plugin does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PoC
Put the following payload in the 'Publish ID or Full URL" setting and save: ">
Related
nvd
nvd
CVE-2021-24902
2021-12-27 11:15:08
cve
cve
CVE-2021-24902
2021-12-27 11:15:08
prion
prion
Cross site scripting
2021-12-27 11:15:00
cvelist
cvelist
CVE-2021-24902 Typebot < 1.4.3 - Admin+ Stored Cross Site Scripting
2021-12-27 10:33:20
wpexploit
wpexploit
Typebot < 1.4.3 - Admin+ Stored Cross Site Scripting
2021-11-29 00:00:00
patchstack
patchstack