WordPress Wordfence 7.4.6 - Cross0Site Scripting

By kannthu

Medium

Vidoc Module

#wordpress#wp-plugin#xss#wordfence

Description

Author: madrobot Classification CWE-ID: CWE-80 CVSS-Metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS-Score: 5.4 WordPress Wordfence 7.4.6 is vulnerable to cross-site scripting. Metadata max-request: 1

Module preview

Concurrent Requests (1)

1. HTTP Request template

GET/wp-content/plugins/...

Matching conditions

word: '>"<svg/onload=confirm('test')>and

word: text/htmland

status: 200

Passive global matcher

No matching conditions.

On match action

Report vulnerability