WordPress Plugin Filterable Portfolio Gallery 1.0 – ‘title’ Stored Cross-Site Scripting (XSS)

• Exploit Database
• 131 阅读

• 作者： Murat DEMİRCİ
  日期： 2021-10-26
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50458/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

  # Exploit Title: WordPress Plugin Filterable Portfolio Gallery 1.0 - &apos;title&apos; Stored Cross-Site Scripting (XSS) # Date: 10/25/2021 # Exploit Author: Murat DEMIRCI (@butterflyhunt3r) # Vendor Homepage: http://www.filterable-portfolio.com/ # Software Link: https://wordpress.org/plugins/fg-gallery/ # Version: 1.0 # Tested on : Windows 10   #Poc:   1. Install Latest WordPress   2. Install and activate Filterable Portfolio Gallery 1.0   3. Open plugin on the left frame and enter JavaScript payload which is mentioned below into &apos;title&apos; field, save and preview.   <img src=x onerror=alert(1)>   4. You will observe that the payload successfully got stored into the database and alert will be seen on the screen.