WordPress Plugin Vulnerabilities
DrawBlog <= 0.90 - Authenticated Stored Cross-Site Scripting (XSS)
Description
The plugin does not sanitise or validate some of its settings before outputting them back in the page, leading to an authenticated stored Cross-Site Scripting issue
Proof of Concept
As admin, put the following payload in the "Checkbox reminder" setting of the plugin: "><script>alert(/XSS/)</script>
Affects Plugins
No known fix References
CVE
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
ABISHEIK M
Submitter
ABISHEIK M
Submitter twitter
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2021-06-28 (about 2 years ago)
Added
2021-06-28 (about 2 years ago)
Last Updated
2022-01-02 (about 2 years ago)
WPScan 