miniOrange's Malware Scanner < 4.5.2 - Admin+ Stored Cross-Site Scripting

2022-06-0600:00:00

Niraj Mahajan

miniorange malware scanner

stored cross-site scripting

admin+

advanced blocking

block http referer's

add referer

exploit

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)

Put the following payload in the "Advanced Blocking" tab > "Block HTTP Referer's" section > "Add Referer" field: "><img src=x onerror=alert(/XSS/)>

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:62FB399D-3327-45D0-B10F-769D2D164903