Lucene search
Asif Nawaz MinhasWPVDB-ID:9579FF13-9597-4A77-8CB9-997E35265D22HistoryAug 02, 2021 - 12:00 a.m.
Sitewide Notice WP < 2.3 - Authenticated Stored XSS
2021-08-0200:00:00
Asif Nawaz Minhas
wpscan.com
7
sitewide notice
authenticated
stored xss
frontend pages
cross-site scripting
unfiltered_html
capability
poc
plugin
settings
payload
message
software
EPSS
0.001
Percentile
24.8%
The plugin does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
PoC
Put the following payload in the Message setting of the plugin: The XSS will be triggered in all frontend pages
Related
patchstack
patchstack
prion
prion
Cross site scripting
2021-08-30 15:15:00
cvelist
cvelist
CVE-2021-24592 Sitewide Notice WP < 2.3 - Authenticated Stored XSS
2021-08-30 14:11:24
wpexploit
wpexploit
Sitewide Notice WP < 2.3 - Authenticated Stored XSS
2021-08-02 00:00:00
nvd
nvd
CVE-2021-24592
2021-08-30 15:15:07
cve
cve
CVE-2021-24592
2021-08-30 15:15:07