| 제목 | Stored XSS in The Events Calendar |
|---|
| 설명 | stored xss in The Events Calendar wordpress plugin that could be insert javascript payload in event detail
1. install latest The Events Calendar wordpress plugin
2. create or edit exist event detail
3. insert like that payload into title and body
<h1 onclick=alert(1)>test</h1>
4. load event page and fire xss
POC:
https://drive.google.com/file/d/1vineiIgIn7xyo3C0V-7__neZHcbP8pgq/view?usp=sharing
https://drive.google.com/file/d/1NMcJYb9HyenkaSK-PxwsS5fOeY6FgrtV/view?usp=sharing |
|---|
| 사용자 | rezaduty (UID 10530) |
|---|
| 제출 | 2022. 11. 01. AM 11:27 (4 연령 ago) |
|---|
| 모더레이션 | 2022. 11. 01. PM 04:33 (5 hours later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 212632 [Events Calendar Plugin 켜짐 WordPress Event post.php title/body 크로스 사이트 스크립팅] |
|---|
| 이유 | not possible without admin permissions |
|---|
| 포인트들 | 0 |
|---|