New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Authenticated(Editor+) Stored Cross-Site Scripting #96

Merged

samiahmedsiddiqui merged 2 commits into main from cross-site-scripting

Aug 20, 2024

Owner

samiahmedsiddiqui commented Aug 20, 2024 •

edited

Loading

Proof of Concept:
As an editor, go to Posts->Tags and add a new tag.

Name the tag: "onmouseover=alert('editor');//
and add any slug/description and a custom permalink slug

Then as an admin or editor visit Custom Permalinks->Taxonomy Permalinks and mouseover the title of the new tag. you should see a popup.


          Authenticated(Editor+) Stored Cross-Site Scripting

caf4d6c

samiahmedsiddiqui self-assigned this


          Few other small fixes

f7d0205

samiahmedsiddiqui merged commit 1079faa into main

10 checks passed

samiahmedsiddiqui deleted the cross-site-scripting branch

August 20, 2024 12:50

samiahmedsiddiqui added bug fixed labels

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels