Post Timeline < 2.2.6 - Reflected XSS

2023-08-1000:00:00

tnt24

wpscan.com

plugin

vulnerability

reflected xss

admin users

invalid nonce

ajax response

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

27.9%

JSON

Description The plugin does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

PoC

Make a logged in admin open the URL below https://example.com/wp-admin/admin-ajax.php?action=ptl_ajax_handler&asl-nounce;=![]()