Sploitus

Exploit for Chained Quiz < 1.2.7.2 - Authenticated Stored Cross Site Scripting

CVE-2021-24690

wpexploit · 2021-09-07

Exploit Code

MARKDOWN8 lines
## https://sploitus.com/exploit?id=WPEX-ID:B2F473B4-268C-48B7-95E8-0A8EEAA3FC28
Open "Chained Quiz > Social Sharing" in the WP admin panel.

Under title field enter the payload : 

"><script>alert(document.domain)</script>

Click on Save All Setting and the XSS will fire every time the Social Sharing page is loaded.