Google Apps Login < 3.4.5 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PoC

1. Go to the setting page of this plugin. 2. In “Advanced Options” » “Login With Google Button Styles” enter the payload: 3. Then click the “Save Changes” button at the bottom. 4. Log out of the WordPress account and then re-enter the user login interface to get the XSS trigger.