ImageBoss < 3.0.6 - Admin+ Stored Cross-Site Scripting
Description
The plugin does not sanitise and escape its Source Name setting, which could allow high privilege users to perform Cross-Site Scripting attacks
Proof of Concept
Put the following payload in the Source Name setting of the plugin: "><script>alert(/XSS/)</script>
Affects Plugins
Fixed in version 3.0.6✓
References
Classification
Miscellaneous
Timeline
Publicly Published
2020-05-11 (about 1 years ago)
Added
2021-10-20 (about 1 months ago)
Last Updated
2021-10-20 (about 1 months ago)