WP Best Quiz <= 1.0 - Author+ Stored XSS

2022-10-2800:00:00

Alpaca

wpscan.com

0.0004 Low

EPSS

Percentile

14.1%

JSON

The plugin does not sanitize and escape some parameters, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks.

PoC

1. Go to Quiz » Add Categories. 2. Inset a category with the payload as name: . 3. The XSS will be trigged when accessing the Add Categories dashboard again.