Lucene search
Taurus OmarWPVDB-ID:4889AD5A-C8C4-4958-B176-64560490497BHistoryJun 19, 2023 - 12:00 a.m.
PrePost SEO <= 3.0 - Admin+ Stored Cross-Site Scripting
2023-06-1900:00:00
Taurus Omar
wpscan.com
19
prepost seo
admin
stored cross-site scripting
unfiltered html
poc
software
settings
xss payload
EPSS
0.001
Percentile
40.1%
The plugin does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PoC
1. Add XSS payload to plugin’s “Account API key” setting: "> 2. Save and see XSS exploit.
Related
prion
prion
Cross site scripting
2023-07-10 16:15:00
packetstorm
packetstorm
WordPress PrePost SEO 3.0 Cross Site Scripting
2023-07-25 00:00:00
wpexploit
wpexploit
PrePost SEO <= 3.0 - Admin+ Stored Cross-Site Scripting
2023-06-19 00:00:00
cve
cve
CVE-2023-2029
2023-07-10 16:15:50
cvelist
cvelist
CVE-2023-2029 PrePost SEO <= 3.0 - Admin+ Stored Cross-Site Scripting
2023-07-10 12:41:01
nvd
nvd
CVE-2023-2029
2023-07-10 16:15:50
wordfence
wordfence