Lucene search
Vishal MohanWPVDB-ID:A6D57FDA-79A7-4BF8-B18E-8CF0A4EFD1B3HistoryNov 15, 2021 - 12:00 a.m.
Inspirational Quote Rotator <= 1.0.0 - Admin+ Stored Cross-Site Scripting
2021-11-1500:00:00
Vishal Mohan
wpscan.com
8
0.001 Low
EPSS
Percentile
24.8%
The plugin does not sanitize and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the “Quotes list” even when the unfiltered_html capability is disallowed
PoC
Add/edit a quote (/wp-admin/options-general.php?page=iqr-settings) and put the following payload in the Title or Content:
| CPE | Name | Operator | Version |
|---|---|---|---|
| inspirational-quote-rotator | eq | * |
Related
cve
cve
CVE-2021-24771
2021-12-13 11:15:08
cvelist
cvelist
nvd
nvd
CVE-2021-24771
2021-12-13 11:15:08
prion
prion
Cross site scripting
2021-12-13 11:15:00
patchstack
patchstack
cnvd
cnvd
WordPress Plugin Cross-Site Scripting Vulnerability (CNVD-2021-101989)
2021-12-18 00:00:00
wpexploit
wpexploit
Inspirational Quote Rotator <= 1.0.0 - Admin+ Stored Cross-Site Scripting
2021-11-15 00:00:00