Edit Report

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2017100095

Below is a copy:

WordPress WP-Contact-Widgets 1.4.1 Cross Site Scripting
# Exploit Title: Stored XSS on wp-contact-widgets 1.4.1 wordpress plugin
# Disclosure Date: 06/10/2017
# Exploit Author: Boumediene KADDOUR
# Publisher: R&D Unit Algerie Telecom
# Version:  1.4.1
# Application website: https://wordpress.org/plugins/contact-widgets/
<https://www.phpjabbers.com/free-rate-me-script/>
# CVE : N/A

The include/class-contact.php miss handles the address field where it
provides the unfiltered_html capability to an authenticated user which
gives him/her the ability to store JS code inside of the address field.

Link to the PoC: https://github.com/godaddy/wp-contact-widgets/issues/46
Link to the fix:
https://github.com/godaddy/wp-contact-widgets/commit/d5824c82860eb5e233054ed7448f817ebc4e390e

Copyright ©2017 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.