id: CVE-2023-3936 info: name: Blog2Social < 7.2.1 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin reference: - https://wpscan.com/vulnerability/6d09a5d3-046d-47ef-86b4-c024ea09dc0f - https://nvd.nist.gov/vuln/detail/CVE-2023-3936 classification: cve-id: CVE-2023-3936 metadata: max-request: 2 verified: true tags: cve,cve2023,wordpress,wp-plugin,xss,authenticated http: - raw: - | POST /wp-login.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded log={{username}}&pwd={{password}}&wp-submit=Log+In - | GET /wp-admin/admin.php?page=blog2social&origin=publish_post&deletePostStatus=success&deletedPostsNumber=1 HTTP/1.1 Host: {{Hostname}} cookie-reuse: true matchers-condition: and matchers: - type: word part: body words: - "Deleted 1 posts" - type: word part: header words: - text/html - type: status status: - 200