Edit Report

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2017100095

Below is a copy:

WordPress WP-Contact-Widgets 1.4.1 Cross Site Scripting
# Exploit Title: Stored XSS on wp-contact-widgets 1.4.1 wordpress plugin
# Disclosure Date: 06/10/2017
# Exploit Author: Boumediene KADDOUR
# Publisher: R&D Unit Algerie Telecom
# Version:  1.4.1
# Application website: https://wordpress.org/plugins/contact-widgets/
# CVE : N/A

The include/class-contact.php miss handles the address field where it
provides the unfiltered_html capability to an authenticated user which
gives him/her the ability to store JS code inside of the address field.

Link to the PoC: https://github.com/godaddy/wp-contact-widgets/issues/46
Link to the fix:

Copyright ©2017 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.