6829e7f3b7
17 changes to exploits/shellcodes RDP Manager 4.9.9.3 - Denial-of-Service (PoC) PHPJabbers Simple CMS 5 - 'name' Persistent Cross-Site Scripting (XSS) WordPress Plugin Hotel Listing 3 - 'Multiple' Cross-Site Scripting (XSS) Fuel CMS 1.4.1 - Remote Code Execution (3) Eclipse Jetty 11.0.5 - Sensitive File Disclosure WordPress Plugin Popup Anything 2.0.3 - 'Multiple' Stored Cross-Site Scripting (XSS) OpenAM 13.0 - LDAP Injection Simplephpscripts Simple CMS 2.1 - 'Multiple' Stored Cross-Site Scripting (XSS) Simplephpscripts Simple CMS 2.1 - 'Multiple' SQL Injection Sonicwall SonicOS 6.5.4 - 'Common Name' Cross-Site Scripting (XSS) PHP Melody 3.0 - 'Multiple' Cross-Site Scripting (XSS) PHP Melody 3.0 - 'vid' SQL Injection Mult-e-Cart Ultimate 2.4 - 'id' SQL Injection PHP Melody 3.0 - Persistent Cross-Site Scripting (XSS) Isshue Shopping Cart 3.5 - 'Title' Cross Site Scripting (XSS) Vanguard 2.1 - 'Search' Cross-Site Scripting (XSS) Ultimate POS 4.4 - 'name' Cross-Site Scripting (XSS)
44 lines
No EOL
1.1 KiB
Text
44 lines
No EOL
1.1 KiB
Text
# Exploit Title: WordPress Plugin Popup Anything 2.0.3 - 'Multiple' Stored Cross-Site Scripting (XSS)
|
|
# Date: 03/11/2021
|
|
# Exploit Author: Luca Schembri
|
|
# Vendor Homepage: https://www.essentialplugin.com/
|
|
# Software Link: https://wordpress.org/plugins/popup-anything-on-click/
|
|
# Version: < 2.0.4
|
|
|
|
** Summary **
|
|
|
|
A user with a low privileged user can perform XSS-Stored attacks.
|
|
|
|
|
|
** Plugin description **
|
|
|
|
Popup Anything is the best popup builder and marketing plugin that
|
|
helps you get more email subscribers, increase sales and grow your
|
|
business.
|
|
|
|
|
|
Manage powerful modal popup for your WordPress blog or website. You
|
|
can add an unlimited popup with your configurations.
|
|
|
|
|
|
** Vulnerable page **
|
|
|
|
http://{WEBSITE}/wp-admin/post.php?post={ID}&action=edit
|
|
|
|
|
|
** PoC **
|
|
|
|
Go on the "Popup Anything - Settings" tab and select "Simple Link" as
|
|
"Link Type". Select "Link Test" and use this payload:
|
|
|
|
test" onclick="alert(1)
|
|
|
|
Save the popup and reload the page. Now click on "Link Text" and it
|
|
will execute the javascript code
|
|
|
|
The same attack can be exploited with "Button Text" and "Popup width" fields.
|
|
|
|
|
|
** Remediation **
|
|
|
|
Upgrade to 2.0.4 version or later |