Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
wpvulndbABISHEIK MWPVDB-ID:5FD2246A-FBD9-4F2A-8B0B-A64C3F91157C
HistoryJun 28, 2021 - 12:00 a.m.

DrawBlog <= 0.90 - Authenticated Stored Cross-Site Scripting (XSS)

2021-06-2800:00:00
ABISHEIK M
wpscan.com
8
JSON

The plugin does not sanitise or validate some of its settings before outputting them back in the page, leading to an authenticated stored Cross-Site Scripting issue

PoC

As admin, put the following payload in the “Checkbox reminder” setting of the plugin: ">

CPENameOperatorVersion
drawblogeq*

Related

prion 1
wpexploit 1
cvelist 1
cve 1
cnvd 1
prion
prion
Cross site scripting
2021-08-02 11:15:00
wpexploit
wpexploit
DrawBlog <= 0.90 - Authenticated Stored Cross-Site Scripting (XSS)
2021-06-28 00:00:00
cvelist
cvelist
CVE-2021-24479 DrawBlog <= 0.90 - Authenticated Stored Cross-Site Scripting (XSS)
2021-08-02 10:32:19
cve
cve
CVE-2021-24479
2021-08-02 11:15:00
cnvd
cnvd
WordPress DrawBlog plugin cross-site scripting vulnerability
2021-08-05 00:00:00
JSON
Related for WPVDB-ID:5FD2246A-FBD9-4F2A-8B0B-A64C3F91157C
prion1wpexploit1cvelist1cve1cnvd1