Lucene search
Shivam RaiWPVDB-ID:ECDDB611-DE75-41D5-A470-8FC2CF0780A4HistoryOct 11, 2021 - 12:00 a.m.
Qwizcards < 3.62 - Admin+ Stored Cross Site Scripting
2021-10-1100:00:00
Shivam Rai
wpscan.com
6
0.001 Low
EPSS
Percentile
24.8%
The plugin does not properly sanitize and escape some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PoC
Within Settings > Qwizcards > Qwizcardsa Option, put the following payload in the Qwizcards-content HTML field v < 3.61 - "> v < 3.62 - " autofocus onfocus=alert(/XSS/)//
| CPE | Name | Operator | Version |
|---|---|---|---|
| qwiz-online-quizzes-and-flashcards | lt | 3.62 |
Related
cve
cve
CVE-2021-24706
2021-11-08 18:15:09
cvelist
cvelist
CVE-2021-24706 Qwizcards < 3.62 - Admin+ Stored Cross Site Scripting
2021-11-08 17:35:10
patchstack
patchstack
prion
prion
Cross site scripting
2021-11-08 18:15:00
nvd
nvd
CVE-2021-24706
2021-11-08 18:15:09
wpexploit
wpexploit
Qwizcards < 3.62 - Admin+ Stored Cross Site Scripting
2021-10-11 00:00:00