WP Staging (Free < 3.4.0, Pro < 5.4.0) - Admin+ Stored XSS

2024-03-2700:00:00

Dmitrii Ignatyev

wpscan.com

wordpress

plugin

vulnerability

stored xss

admin

settings

unfiltered html

multisite

4.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

PoC

1. Go to “WP Staging > Backup & Migration” 2. Edit an existing backup’s “Backup Name” field, setting it to: 123123" onmouseover='alert(1)' 3. Save and see the XSS when reopening the edit screen