WordPress Plugin Vulnerabilities

ImageBoss < 3.0.6 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape its Source Name setting, which could allow high privilege users to perform Cross-Site Scripting attacks

Proof of Concept

Put the following payload in the Source Name setting of the plugin: "><script>alert(/XSS/)</script>

Affects Plugins

Fixed in 3.0.6

References

Classification

Type
XSS
CWE
CVSS

Miscellaneous

Original Researcher
Chevon Phillip
Verified
Yes

Timeline

Publicly Published
2020-05-11 (about 3 years ago)
Added
2021-10-20 (about 2 years ago)
Last Updated
2022-04-14 (about 1 years ago)

Other