WordPress Training Membership 1.0.8 Cross Site Scripting

CVE	Category	Price	Severity
CVE-2020-12345	CWE-79	$500	High

Author	Risk	Exploitation Type	Date
Exploit Author	High	Remote	2017-09-09

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2017090062

Below is a copy:

WordPress Training Membership 1.0.8 Cross Site Scripting# Exploit Title: Wordpress Fitness Trainer - Training Membership Plugin <= v1.0.8 - Authenticated Stored/Reflected XSS
# Date: 2017-09-07
# Exploit Author: 8bitsec
# Vendor Homepage: https://codecanyon.net/item/fitness-trainer-training-membership-plugin/19901278
# Software Link: https://codecanyon.net/item/fitness-trainer-training-membership-plugin/19901278
# Version: 1.0.8
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: [email protected]
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-09-07

Product & Service Introduction:
===============================
Fitness Trainer - Training Membership Plugin

Technical Details & Description:
================================

Authenticated Stored XSS vulnerability found on Account Settings section.
Reflected XSS on profile parameter.

Proof of Concept (PoC):
=======================

Authenticated Stored XSS:

Logged as a low priv user.
Account Settings Section. Vulnerable Fields:
First Name
Last Name
Occupation
About
Website URL

Authenticated Reflected XSS on profile parameter:

https://localhost/fitnessp/my-account/?profile=<svg/onload=alert(document.domain)>

==================
8bitsec - [https://twitter.com/_8bitsec]

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum