Rencontre < 3.2 – Authenticated Stored XSS via textmail & textanniv Parameters

Description

An authenticated persistent cross-site scripting vulnerability has been found in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in the victim's browser when they visit the web site.

Proof of Concept

# Affected Version ~ Version: <= 3.1.3

# Reproduction Steps:

0. Auth Stored XSS in two Parameters

1. Login in WordPress and go to Plugin Email page (http://192.168.144.128/wp-admin/admin.php?page=rencontre.php&renctab=mel)

2. Under the "Introductory text for the summary email (After hello login - Before the smiles and contact requests)" & "Full text for the birthday mail (After hello pseudo)" there is a text area

3. Enter/paste the payload & save

# POC:
Prameter: textmail & textanniv
Payload: </textarea></td><script>alert('XSS')</script>//
Encoded-Payload: %3C%2Ftextarea%3E%3C%2Ftd%3E%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E%2F%2F