Lucene search

Dmitrii IgnatyevWPVDB-ID:36F95B19-AF74-4C56-9848-8FF270AF4723

HistoryMar 25, 2024 - 12:00 a.m.

Super Socializer < 7.13.64 - Editor+ Stored XSS

2024-03-2500:00:00

Dmitrii Ignatyev

wpscan.com

plugin

vulnerability

stored xss

unfiltered_html

editors

cross-site scripting

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

PoC

When creating a new widget, insert the following payload in the “FaceBook URL” field - 40"asdasd=‘’;"

CPENameOperatorVersion
eq7.13.64

CPE	Name	Operator	Version
		eq	7.13.64