WPQA < 6.1.1 - Contributor+ Stored XSS

2024-06-1200:00:00

Bob Matyas

wpscan.com

plugin

slider settings

stored xss

high privilege users

sanitization

AI Score

5.5

Confidence

High

EPSS

Percentile

14.2%

JSON

Description The plugin does not sanitise and escape some of its Slider settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks

PoC

The PoC will be displayed on June 26, 2024, to give users the time to update.