tagDiv Composer < 4.2 - Admin+ Stored XSS

Description The plugin, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

PoC

1. Visit Newsmag > Plugins and install and activate “tagDiv Composer” 2. Visit Newsmag > Theme panel > Custom Code 3. Enter the following in “Custom CSS” and click “Save Settings”: