| शीर्षक | Stored XSS in The Events Calendar |
|---|
| विवरण | stored xss in The Events Calendar wordpress plugin that could be insert javascript payload in event detail
1. install latest The Events Calendar wordpress plugin
2. create or edit exist event detail
3. insert like that payload into title and body
<h1 onclick=alert(1)>test</h1>
4. load event page and fire xss
POC:
https://drive.google.com/file/d/1vineiIgIn7xyo3C0V-7__neZHcbP8pgq/view?usp=sharing
https://drive.google.com/file/d/1NMcJYb9HyenkaSK-PxwsS5fOeY6FgrtV/view?usp=sharing |
|---|
| उपयोगकर्ता | rezaduty (UID 10530) |
|---|
| सबमिशन | 01/11/2022 11:27 AM (4 साल पहले) |
|---|
| संयम | 01/11/2022 04:33 PM (5 hours later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 212632 [Events Calendar Plugin पर WordPress Event post.php title/body क्रॉस साइट स्क्रिप्टिंग] |
|---|
| व्याख्या | not possible without admin permissions |
|---|
| अंक | 0 |
|---|