Lucene search

EmadWPVDB-ID:E866A214-A142-43C7-B93D-FF2301A3E432

HistorySep 25, 2023 - 12:00 a.m.

PowerPress Podcasting < 11.0.12 - Contributor+ Stored XSS

2023-09-2500:00:00

emad

wpscan.com

wordpress

plugin

security

xss

vulnerability

privileges

injection

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

20.8%

JSON

Description The plugin does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.

PoC

Add the following payload to the Media URL field: