WordPress Plugin Vulnerabilities
WP Subscribe < 1.2.13 - Admin+ Stored Cross-Site Scripting
Description
The plugin does not sanitise and escape some of its widgets settings, which could allow high privilege users such as admin to perform Cross-Site Scripting even when unfiltered_html is disallowed
Proof of Concept
Add the widget of the plugin to a page, and put the following payload in settings such as "Title", "Text", "Email Placeholder" etc: "><img src onerror=alert(/XSS/)>
Affects Plugins
Fixed in 1.2.13 References
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Asif Nawaz Minhas
Verified
No
WPVDB ID
Timeline
Publicly Published
2022-05-02 (about 1 years ago)
Added
2022-05-02 (about 1 years ago)
Last Updated
2022-08-02 (about 1 years ago)
WPScan 