WordPress Plugin Vulnerabilities
PhoneTrack Meu Site Manager <= 0.1 - Authenticated Stored XSS
Description
The plugin does not sanitise or escape its "php_id" setting before outputting it back in an attribute in the page, leading to a stored Cross-Site Scripting issue.
Proof of Concept
Put the following payload in the "php_id" field in the plugin's settings (/wp-admin/options-general.php?page=phtmanager): "><script>alert(/XSS/)</script>
Affects Plugins
No known fix - plugin closed
References
Classification
Miscellaneous
Original Researcher
ABISHEIK M
Submitter
ABISHEIK M
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2021-07-19 (about 1 years ago)
Added
2021-07-19 (about 1 years ago)
Last Updated
2023-01-23 (about 4 months ago)