跳转到帖子

WordPress Plugin Filterable Portfolio Gallery 1.0 - 'title' Stored Cross-Site Scripting (XSS)

recommended_posts

发布于
  • Members
# Exploit Title: WordPress Plugin Filterable Portfolio Gallery 1.0 - 'title' Stored Cross-Site Scripting (XSS)
# Date: 10/25/2021
# Exploit Author: Murat DEMIRCI (@butterflyhunt3r)
# Vendor Homepage: http://www.filterable-portfolio.com/
# Software Link: https://wordpress.org/plugins/fg-gallery/
# Version: 1.0
# Tested on : Windows 10

#Poc:

1. Install Latest WordPress

2. Install and activate Filterable Portfolio Gallery 1.0

3. Open plugin on the left frame and enter JavaScript payload which is mentioned below into 'title' field, save and preview.

<img src=x onerror=alert(1)> 

4. You will observe that the payload successfully got stored into the database and alert will be seen on the screen.
            
  • 查看数 700
  • 已创建
  • 最后回复

参与讨论

你可立刻发布并稍后注册。 如果你有帐户,立刻登录发布帖子。

游客
回帖…