WordPress Plugin Vulnerabilities
BannerMan <= 0.2.4 - Multiple Admin+ Stored Cross-Site Scripting
Description
The plugin does not sanitize or escape its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed (such as in multisite)
Proof of Concept
As administrator, put the following payloads in the mentioned settings of the plugin (/wp-admin/options-general.php?page=bannerman) then save - </textarea><svg/onload=prompt(/XSS/)> in any of the textarea fields, like "Style your banner with CSS:" - "><script>alert(/XSS/)</script> in any of the text fields like "Background colour"
Affects Plugins
No known fix - plugin closed
References
Classification
Miscellaneous
Original Researcher
Fayçal CHENA
Submitter
Fayçal CHENA
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2022-05-09 (about 10 months ago)
Added
2022-05-09 (about 10 months ago)
Last Updated
2022-05-10 (about 10 months ago)