Custom Dashboard & Login Page < 7.0 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Note: v6.9.5 made the settings only available to admin with the unfiltered_html capability, however existing payloads were not sanitised and there was no simple way to remove them other than editing the settings directly in the DB.

PoC

Put the following payload in the "Change version text"or “Change footer text” setting of the plugin (/wp-admin/tools.php?page=ag-custom-admin%2Fplugin.php#admin-footer-settings): The XSS will be triggered in all admin pages