CC Child Pages < 1.43 - Contributor+ Stored XSS via Shortcode

2023-01-0500:00:00

Lana Codes

stored xss

contributor+

shortcode

EPSS

0.001

Percentile

25.5%

JSON

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Exploit: 

[child_pages link_target='" onmouseover="alert(1)" style="background:red;"']

Note: This should be added to a page and should be a parent page. So the page you add it to must be a child of it, as this lists the child pages.

EPSS

0.001

Percentile

25.5%

JSON

Related for WPEX-ID:D5EA8F7F-7D5A-4B2E-A070-A9AEF7CAC58A