WordPress Plugin Vulnerabilities
Mihdan: No External Links < 5.0.2 - Admin+ Stored Cross-Site Scripting
Description
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Proof of Concept
Put the following payload in any of the text fields in the Settings > Links of the plugin (/wp-admin/admin.php?page=mihdan-no-external-links&tab=links): v < 4.8.0 - "><img src onerror=prompt(/XSS/)> v < 5.0.2 - " style=animation-name:rotation onanimationstart=alert(/XSS/)//
Affects Plugins
Fixed in version 5.0.2
References
Classification
Miscellaneous
Original Researcher
Vaibhav Nitin Gaikwad
Submitter
Vaibhav Nitin Gaikwad
Submitter website
Verified
Yes
Timeline
Publicly Published
2022-06-02 (about 9 months ago)
Added
2022-06-02 (about 9 months ago)
Last Updated
2023-03-03 (about 21 days ago)