WordPress Plugin Vulnerabilities
Dropdown Menu Widget <= 1.9.7 - Subscriber+ Arbitrary Settings Update to Stored XSS
Description
The plugin does not have authorisation and CSRF checks when saving its settings, allowing low privilege users such as subscriber to update them. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
Proof of Concept
Open the following URL as a subscriber: https://example.com/wp-admin/admin.php?shailan_dm_active_theme=*url*&shailan_dm_theme_url="><script>alert(/XSS/);</script>&action=save&page=dropdown-menu You'll get a permission denied message. Ignore it and browse to https://example.com or the plugin's settings to trigger the XSS
Affects Plugins
No known fix - plugin closed
References
Classification
Miscellaneous
Original Researcher
Krzysztof Zając
Submitter
Krzysztof Zając
Submitter website
Verified
Yes
Timeline
Publicly Published
2022-03-14 (about 6 months ago)
Added
2022-03-14 (about 6 months ago)
Last Updated
2022-04-09 (about 5 months ago)