| Título | Stored XSS in The Events Calendar |
|---|
| Descripción | stored xss in The Events Calendar wordpress plugin that could be insert javascript payload in event detail
1. install latest The Events Calendar wordpress plugin
2. create or edit exist event detail
3. insert like that payload into title and body
<h1 onclick=alert(1)>test</h1>
4. load event page and fire xss
POC:
https://drive.google.com/file/d/1vineiIgIn7xyo3C0V-7__neZHcbP8pgq/view?usp=sharing
https://drive.google.com/file/d/1NMcJYb9HyenkaSK-PxwsS5fOeY6FgrtV/view?usp=sharing |
|---|
| Usuario | rezaduty (UID 10530) |
|---|
| Sumisión | 2022-11-01 11:27 (hace 4 años) |
|---|
| Moderación | 2022-11-01 16:33 (5 hours later) |
|---|
| Estado | Duplicado |
|---|
| Entrada de VulDB | 212632 [Events Calendar Plugin en WordPress Event post.php title/body secuencias de comandos en sitios cruzados] |
|---|
| Razón | not possible without admin permissions |
|---|
| Puntos | 0 |
|---|