.. / CVE-2022-4260

• XSS
• Nuclei
• Web

Exploit for WordPress WP-Ban <1.69.1 - Stored Cross-Site Scripting (CVE-2022-4260)

Description:

WordPress WP-Ban plugin before 1.69.1 contains a stored cross-site scripting vulnerability. The plugin does not sanitize and escape some of its settings, which can allow high-privilege users to steal cookie-based authentication credentials and launch other attacks. This vulnerability can be exploited even when the unfiltered_html capability is disallowed, for example in multisite setup.

Nuclei Template

View the template here CVE-2022-4260.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-4260.yaml

References: