Sploitus

Exploit for W4 Post List < 2.4.6 - Contributor+ Stored XSS

CVE-2023-0374

wpexploit · 2023-03-22

Exploit Code

MARKDOWN4 lines
## https://sploitus.com/exploit?id=WPEX-ID:DDB10F2E-73B8-444C-90B2-5C84CDF6DE5C
On a post, add a "W4 Post List" block, select a list and put the following payload in the "Additional CSS class(es)" option: " onmouseover="alert(/XSS/)" style="background:red;"

The XSS will be triggered when previewing/viewing the post and moving the mouse over the red block