WordPress Plugin Vulnerabilities
Donorbox 7.1~7.1.1 - Stored Cross-Site Scripting via Shortcode
Description
In Donorbox WordPress plugin, one can perform an XSS attack via the included shortcode by inserting arbitrary HTML attributes. This vulnerability was introduced in v7.1 and fixed in v7.1.2.
Proof of Concept
[donate url='/\?\" autofocus onfocus=\"alert(window)\" abitraryAttributeToValidateShortcodeParsing=\"']
Affects Plugins
Fixed in version 7.1.2
References
Classification
Miscellaneous
Original Researcher
Sybre Waaijer
Submitter
Sybre Waaijer
Submitter website
Submitter twitter
Verified
No
Timeline
Publicly Published
2019-12-31 (about 3 years ago)
Added
2019-12-31 (about 3 years ago)
Last Updated
2020-01-01 (about 3 years ago)