WordPress Plugin Vulnerabilities
Best Contact Management Software <= 3.7.3 - Admin+ Stored Cross-Site Scripting
Description
The plugin does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Proof of Concept
Put the following payload in the "No Access Message" settings (/wp-admin/admin.php?page=wp_easy_contact_settings&tab=misc): <script>alert(/XSS/);</script> The XSS will be triggered when someone access any quote without enough privileges
Affects Plugins
No known fix - plugin closed
References
Classification
Miscellaneous
Original Researcher
Benachi
Submitter
Benachi
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2022-06-21 (about 9 months ago)
Added
2022-06-21 (about 9 months ago)
Last Updated
2023-03-27 (about 1 days ago)