WordPress Plugin Vulnerabilities
BulletProof Security < 5.8 - Admin+ Stored Cross-Site Scripting (XSS)
Description
The plugin does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Proof of Concept
As admin, put the following payloads: - # </textarea><svg/onload=prompt(/XSS/)> in the htaccess File Options > htaccess File Editor > secure.htaccess texture field and save - "><svg/onload=prompt(/XSS/)> in JTC Lite > Login Form: CAPTCHA Error message / Comment Form: CAPTCHA Error message (BPS Pro Only) fields and save
Affects Plugins
Fixed in version 5.2
References
Classification
Miscellaneous
Original Researcher
Mika
Submitter
Mika
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2022-02-22 (about 4 months ago)
Added
2022-02-22 (about 4 months ago)
Last Updated
2022-04-10 (about 2 months ago)