MS-Reviews <= 1.5 - Subscriber+ Stored XSS

2023-03-2800:00:00

Rio Darmawan

wpscan.com

ms-reviews

stored xss

subscriber

frontend

vulnerability

0.001 Low

EPSS

Percentile

23.7%

JSON

The plugin does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks

PoC

As a subscriber, submit a review (a page/post with [ms_reviews] embed) with the following payload: The XSS will be triggered when anyone (including an admin) will view the page/post in the frontend