PostX < 4.0.2 - Contributor+ Stored XSS

2024-04-2200:00:00

Dmitrii Ignatyev

postx

stored xss

contributor+

ultimate post heading

exploit

8.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

Description The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

1. Create a new Post and add "Ultimate post Heading" block. Change "headingURL" field to `123" onmouseover=alert(1)//`

2. Browse the post and hover over the heading.