WordPress Plugin Vulnerabilities
Media-Tags <= 3.2.0.2 - Admin+ Stored Cross-Site Scripting
Description
The plugin does not sanitise and escape any of its Labels settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_htnl capability is disallowed.
Proof of Concept
https://drive.google.com/file/d/1ZXIS-q2fzZhRhTyHpHEzxc_Z2Shl4Up2/view?usp=sharing Put the following payload in any of the Media-Tags Labels settings (/wp-admin/admin.php?page=mediatags_settings_panel): "><img src=x onerror=confirm(/XSS/)>
Affects Plugins
No known fix - plugin closed
References
Classification
Miscellaneous
Original Researcher
Akash Rajendra Patil
Submitter
Akash Rajendra Patil
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2021-10-25 (about 11 months ago)
Added
2021-10-26 (about 11 months ago)
Last Updated
2022-04-13 (about 5 months ago)