Pz-LinkCard < 2.5.3 - Admin+ Stored XSS

2024-03-0700:00:00

Dmitrii Ignatyev

pz-linkcard

stored xss

admin+

vulnerability

plugin

exploit

blogcard shortcode

8.6 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Put the following payload in the "Class ID to be Added (for PC)" setting of the plugin (/wp-admin/options-general.php?page=pz-linkcard-settings > Advanced): " onmouseover=alert(/XSS/)//

Then open page/post containing a blogcard shortcode (such as [blogcard url="aaa"]) and move the mouse over the generated card to trigger the XSS