Wednesday, May 26, 2021

WordPress Cookie Law Bar 1.2.1 Cross Site Scripting

# Exploit Title: WordPress Plugin Cookie Law Bar 1.2.1 - 'clb_bar_msg' Stored Cross-Site Scripting (XSS)
# Date: 2021-05-24
# Exploit Author: Mesut Cetin
# Vendor Homepage:
# Software Link:
# Version: 1.2.1
# Tested on: Ubuntu 16.04 LTS, Wordpress 5.7.2

# the "Bar Message" text field is vulnerable to stored XSS due to unsanitized user input
# an authenticated attacker can retrieve cookies / sensitive data of all Wordpress users

# proof of concept
# navigate to the settings of the Cookie Law Bar under


# inject the payload: </script><script>alert(document.cookie)</script> into the "Bar Message field" and save it

# browsing through the Wordpress pages shows the cookies

Copyright © 2020 Cyber Details - Vulnerability Database™

Thanks for everything Templateism - You should have written the code a little more complicated