Novelist < 1.2.1 - Admin+ Stored XSS

2023-05-2200:00:00

wpscan.com

novelist

plugin

vulnerability

xss

admin

stored

settings

sanitize

escape

fields

high-privilege

web scripts

unfiltered_html

capability

multisite

EPSS

0.001

Percentile

17.7%

JSON

The plugin does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).

References

patchstack.com/database/vulnerability/novelist/wordpress-novelist-plugin-1-2-0-cross-site-scripting-xss-vulnerability

www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/novelist/novelist-120-authenticated-administrator-stored-cross-site-scripting-via-book-information-fields

EPSS

0.001

Percentile

17.7%

JSON

Related for WPVDB-ID:3699F6F6-0AE4-4DD3-9CB0-1138D799E848