Buttonizer - Smart Floating Action Button < 2.5.5 - Admin+ Stored Cross-Site Scripting

2021-11-2900:00:00

th3.d1p4k

buttonizer

cross-site scripting

admin+

exploit

security vulnerability

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Add/edit a new button, set its Button action to "Website URL" and add the following payload as URL: javascript:alert(/XSS/)

As label, the following payload can be used as well: <img src onerror=alert(/XSS-Label/)>

Publish it and the XSS will be triggered when viewing the page with the button (w/o user interaction for the XSS in the label field, while clicking on it for the XSS in the URL)

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:DB0B9480-2FF4-423C-A745-68E983FFA12B