Headline
WordPress WP Brutal AI Cross Site Scripting
WordPress WP Brutal AI plugin versions prior to 2.06 suffer from a persistent cross site scripting vulnerability.
Tittle:WordPress Plugin WP Brutal AI < 2.06 - Admin+ Stored XSSReferences:CVE-2023-2606Author:Taurus Omar Description:The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).Affects Plugins:WP Brutal AI - Fixed in version 2.06Proof of Concept:Visit the following path:1. Go to Settings » WP Brutal AI2. Add new campaign 4. Add name payload: "><iframe src="<svg onload=alert(4);>"> 3. Save the changes to trigger XSS. Classification:Type XSS OWASP top 10 A7: Cross-Site Scripting (XSS)CWE-79wpScan:https://wpscan.com/vulnerability/62deb3ed-a7e4-4cdc-a615-cad2ec2e1e8fRelated news
CVE-2023-2606
The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).