WordPress Popup-Builder plugin version 3.61.1 suffers from a cross site scripting vulnerability.
f7012987c3cc2c05c511a4205cca25c1[-] Title : word press plugin popup-builder 3.61.1 - Cross-Site Scripting
[-] Author : MEHRAN_FEIZI
[-] Vendor : https://wordpress.org/plugins/popup-builder/
[-] Tested on : Windows
[-] Category : Webapps
[-] Date : 2020-02-20
=====================================================================================================
Vulnerable page :
popup-builder/com/classes/dataTable/Subscribers.php
======================================================================================================
Vulnerable Source :
141: echo echo $selectedDate; // AdminHelper.php
136: $selectedDate = esc_sql($_GET['sgpb-subscribers-date']);
=======================================================================================================
POC :
http://localhost/wp-content/plugins/popup-builder/com/classes/dataTable/Subscribers.php?sgpb-subscribers-date=[XSS]
=======================================================================================================
************************
* ==> Contact With We :
* Telegram : @MF0584
* Email : [email protected]
************************