Lucene search
Rohan ChaudhariWPVDB-ID:3FC7986E-3B38-4E16-9516-2AE00BC7A581HistoryJul 26, 2022 - 12:00 a.m.
Simple Banner < 2.12.0 - Admin+ Stored Cross Site Scripting
2022-07-2600:00:00
Rohan Chaudhari
wpscan.com
7
0.001 Low
EPSS
Percentile
22.7%
The plugin does not properly sanitize its “Simple Banner Text” Settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PoC
Put the following payloads in the “Simple Banner Text” settings of the plugin: [Firefox](<jav ascript:alert(document.cookie)>) ript>alert(/XSS/)ipt> Then access the frontend to trigger the XSS
| CPE | Name | Operator | Version |
|---|---|---|---|
| simple-banner | lt | 2.12.0 |
Related
prion
prion
Cross site scripting
2022-08-22 15:15:00
wpexploit
wpexploit
Simple Banner < 2.12.0 - Admin+ Stored Cross Site Scripting
2022-07-26 00:00:00
cve
cve
CVE-2022-0446
2022-08-22 15:15:13
nvd
nvd
CVE-2022-0446
2022-08-22 15:15:13
cvelist
cvelist
CVE-2022-0446 Simple Banner < 2.12.0 - Admin+ Stored Cross Site Scripting
2022-08-22 14:57:00