Friday, October 29, 2021

WordPress Supsystic Contact Form 1.7.18 Cross Site Scripting

# Exploit Title: WordPress Plugin Supsystic Contact Form  1.7.18 - 'label' Stored Cross-Site Scripting (XSS)
# Date: 10/27/2021
# Exploit Author: Murat DEMIRCI (@butterflyhunt3r)
# Vendor Homepage: https://supsystic.com/
# Software Link: https://wordpress.org/plugins/contact-form-by-supsystic/
# Version: 1.7.18
# Tested on : Windows 10

#Poc:

1. Install Latest WordPress

2. Install and activate plugin.

3. Open plugin, click "Add New Form" and select any form.

4. Click "Fields" tab and "Add New Field". Choose whatever you want.

5. Inject JavaScript payload which is mentioned below into 'label' field, save and alert will appear on the screen.

Payload : <img src=x onerror=alert(1)>

 

Copyright © 2021 Vulnerability Database | Cyber Details™

thank you Templateism for the design - You should have written the code a little more complicated - Nothing Encrypted anymore