CVE-2016-20066
HIGHWordPress CP Polls 1.0.8 Persistent Cross-Site Scripting
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2016-20066. PoCs published by i0akiN SEC-LABORATORY.
AI-analyzed exploit summary The exploit demonstrates a CSRF vulnerability in WordPress CP Polls 1.0.8, allowing an attacker to update poll settings and inject persistent XSS payloads via crafted HTTP requests. It also includes a proof-of-concept for a reflected file download attack by manipulating the poll name to execute arbitrary commands.
Description
WordPress CP Polls 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unsanitized file upload functionality. Attackers can upload files containing script payloads with event handlers like onerror attributes to execute arbitrary JavaScript in the browsers of users viewing the affected content.
Exploits (1)
The exploit demonstrates a CSRF vulnerability in WordPress CP Polls 1.0.8, allowing an attacker to update poll settings and inject persistent XSS payloads via crafted HTTP requests. It also includes a proof-of-concept for a reflected file download attack by manipulating the poll name to execute arbitrary commands.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N