CVE-2019-20204

MEDIUM

Postie < 1.9.40 - Cross-Site Scripting via SVG Element

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-20204. PoCs published by V1n1v131r4.

AI-analyzed exploit summary This exploit demonstrates a persistent XSS vulnerability in WordPress Plugin Postie 1.9.40 via a crafted SVG payload. It includes steps for identifying the plugin, enumerating email accounts, and spoofing emails using PHPMailer.

Description

The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.

Exploits (1)

exploitdb WORKING POC

by V1n1v131r4 · textwebappsphp

https://www.exploit-db.com/exploits/47925

View Code ZIP pw:eip

This exploit demonstrates a persistent XSS vulnerability in WordPress Plugin Postie 1.9.40 via a crafted SVG payload. It includes steps for identifying the plugin, enumerating email accounts, and spoofing emails using PHPMailer.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Moderate

Reliability

Reliable

Target: WordPress Plugin Postie <=1.9.40

No auth needed

Prerequisites: Target must have WordPress Plugin Postie installed · Ability to send emails to the target's Postie email address

MITRE ATT&CK