| عنوان | Stored XSS in The Events Calendar |
|---|
| الوصف | stored xss in The Events Calendar wordpress plugin that could be insert javascript payload in event detail
1. install latest The Events Calendar wordpress plugin
2. create or edit exist event detail
3. insert like that payload into title and body
<h1 onclick=alert(1)>test</h1>
4. load event page and fire xss
POC:
https://drive.google.com/file/d/1vineiIgIn7xyo3C0V-7__neZHcbP8pgq/view?usp=sharing
https://drive.google.com/file/d/1NMcJYb9HyenkaSK-PxwsS5fOeY6FgrtV/view?usp=sharing |
|---|
| المستخدم | rezaduty (UID 10530) |
|---|
| ارسال | 01/11/2022 11:27 AM (4 سنوات منذ) |
|---|
| الاعتدال | 01/11/2022 04:33 PM (5 hours later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 212632 [Events Calendar Plugin على WordPress Event post.php title/body البرمجة عبر المواقع] |
|---|
| السبب | not possible without admin permissions |
|---|
| النقاط | 0 |
|---|