WordPress Plugin Vulnerabilities
Erident Custom Login and Dashboard < 3.5.9 - Authenticated Stored Cross-Site Scripting (XSS)
Description
The plugin did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them (even when the unfileted_html is disabled)
Proof of Concept
Use a payload such as a"><img src onerror=alert(/XSS/)> in the plugin settings (for example, the Powered by Text input)
Affects Plugins
Fixed in version 3.5.9
References
Classification
Miscellaneous
Original Researcher
James Calver, Bulletproof Cyber
Verified
Yes
Timeline
Publicly Published
2021-04-01 (about 2 years ago)
Added
2021-04-02 (about 2 years ago)
Last Updated
2022-03-07 (about 1 years ago)