WordPress Plugin Popup Anything 2.0.3 – ‘Multiple’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Popup Anything 2.0.3 - 'Multiple' Stored Cross-Site Scripting (XSS) # Date: 03/11/2021 # Exploit Author: Luca Schembri # Vendor Homepage: https://www.essentialplugin.com/ # Software Link: https://wordpress.org/plugins/popup-anything-on-click/ # Version: < 2.0.4 ** Summary ** A user with a low privileged user can perform XSS-Stored attacks. ** Plugin description ** Popup Anything is the best popup builder and marketing plugin that helps you get more email subscribers, increase sales and grow your business. Manage powerful modal popup for your WordPress blog or website. You can add an unlimited popup with your configurations. ** Vulnerable page ** http://{WEBSITE}/wp-admin/post.php?post={ID}&action=edit ** PoC ** Go on the "Popup Anything - Settings" tab and select "Simple Link" as "Link Type". Select "Link Test" and use this payload: test" onclick="alert(1) Save the popup and reload the page. Now click on "Link Text" and it will execute the javascript code The same attack can be exploited with "Button Text" and "Popup width" fields. ** Remediation ** Upgrade to 2.0.4 version or later |