WordPress Calls to Action <= 2.2.7 - Stored XSS

Description

The AJAX action ‘inbound_form_save’ allows unauthenticated users to update the content of any specific form on the site. In order to exploit this, a form ID must be enumerated using another unauthenticated AJAX action, ‘inbound_get_form_data’. Once a form ID has been enumerated, the content of the form may be overwritten a request like the one constructed in the PoC below. This allows for a Persistent XSS to be achieved on any page that a form is used, as no validation is performed on the input of the ‘shortcode’ field data.