| Название | Stored XSS in The Events Calendar |
|---|
| Описание | stored xss in The Events Calendar wordpress plugin that could be insert javascript payload in event detail
1. install latest The Events Calendar wordpress plugin
2. create or edit exist event detail
3. insert like that payload into title and body
<h1 onclick=alert(1)>test</h1>
4. load event page and fire xss
POC:
https://drive.google.com/file/d/1vineiIgIn7xyo3C0V-7__neZHcbP8pgq/view?usp=sharing
https://drive.google.com/file/d/1NMcJYb9HyenkaSK-PxwsS5fOeY6FgrtV/view?usp=sharing |
|---|
| Пользователь | rezaduty (UID 10530) |
|---|
| Представление | 01.11.2022 11:27 (4 лет назад) |
|---|
| Модерация | 01.11.2022 16:33 (5 hours later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 212632 [Events Calendar Plugin на WordPress Event post.php title/body межсайтовый скриптинг] |
|---|
| Причина | not possible without admin permissions |
|---|
| Баллы | 0 |
|---|