WordPress Plugin CP Blocks 1.0.14 – Stored Cross Site Scripting (XSS)

• Exploit Database
• 109 阅读

• 作者： Shweta Mahajan
  日期： 2022-02-08
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50724/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

  # Exploit Title: WordPress Plugin CP Blocks 1.0.14 - Stored Cross Site Scripting (XSS) # Date: 2022-02-02 # Exploit Author: Shweta Mahajan # Vendor Homepage: https://wordpress.org/plugins/cp-blocks/ # Software Link: https://wordpress.org/plugins/cp-blocks/ # Tested on Windows # CVE: CVE-2022-0448 # Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0448 https://wpscan.com/vulnerability/d4ff63ee-28e6-486e-9aa7-c878b97f707c   How to reproduce vulnerability:   1. Install Latest WordPress   2. Install and activate CP Blocks Version 1.0.14   3. Navigate to CP Blocks - License >> enter the payload into &apos;License ID&apos;.   4. Enter JavaScript payload which is mentioned below "><script>alert(0)</script>   5. You will observe that the payload successfully got stored into the database and when you are triggering the same functionality at that time JavaScript payload gets executed successfully and we&apos;ll get a pop-up.