WordPress Plugin Vulnerabilities
Add Subtitle <= 1.1.0 - Contributor+ Stored Cross-Site Scripting
Description
The plugin does not sanitise or escape the sub-title field (available only with classic editor) when output in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
Proof of Concept
(The classic editor plugin is needed to see the sub-title field) - Create a post as contributor+ - Add the following payload in the sub-title field: <script>alert(/XSS/)</script> - View/preview the post to trigger the XSS
Affects Plugins
No known fix - plugin closed
References
Classification
Miscellaneous
Original Researcher
Francesco Carlucci
Submitter
Francesco Carlucci
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2022-01-26 (about 8 months ago)
Added
2022-02-15 (about 7 months ago)
Last Updated
2022-04-08 (about 5 months ago)