{"uuid": "7e9e7c9b-f360-4f01-bf1c-51c6f14c85dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24664", "type": "seen", "source": "https://t.me/hacking_Attack/31523", "content": "Exploit Collector\nWordPress WPSchoolPress 2.1.16 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-cErR-NKa5pU/WWlvUH06dSI/AAAAAAAAINw/w0uVuk51vEgh40coJSJAKFsc2nT9tBwYgCLcBGAs/s1600/h44.png \nWordPress WPSchoolPress plugin version 2.1.16 suffers from cross site scripting vulnerabilities.\n\nMD5 | 729a454da76a432cc4eb46e692268e44\n\nDownload\n# Exploit Title: WordPress Plugin WPSchoolPress 2.1.16 - 'Multiple' Cross Site Scripting (XSS)\n# Date: 20/08/2021\n# Exploit Author: Davide Taraschi\n# Vendor Homepage: https://wpschoolpress.com/\n# Software Link: https://wpschoolpress.com/free-download/\n# Version: up to 2.1.17 (non included)\n# Tested on: Ubuntu 20.04 over WordPress 5.8 and apache2\n# CVE : CVE-2021-24664\n\n# Description:\nThe plugin sanitise some fields using a wordpress built-in function called sanitize_text_field() but does not correctly escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues.\nThe function wp_sanitize_text_field() escape < and > but does not escape characters like \", allowing an attacker to break a HTML input tag and inject arbitrary javascript.\n\n# PoC:\nAs admin,\n- Add a new teacher attendance (/wp-admin/admin.php?page=sch-teacherattendance), Tick the Absent box and put the following payload in the Reason: \"style=animation-name:rotation onanimationstart=alert(/XSS/)//\nThe XSS will be triggered when adding another teacher attendance by clicking on the Add button\n\n- Add a new Student Attendance (/wp-admin/admin.php?page=sch-attendance), tick the Absent box and put the following payload in the Reason: \" style=animation-name:rotation onanimationstart=alert(/XSS/)//\nThe XSS will be triggered when adding another attendance by clicking the 'Add/Update' button\n\n- Add a new Subject Mark Field (/wp-admin/admin.php?page=sch-settings&sc=subField) and put the following payload in the 'Field': \" autofocus onfocus=alert(/XSS/)//\nThe XSS will be triggered when editing the created Subject Mark (ie /admin.php?page=sch-settings&sc=subField&ac=edit&sid=3)\n\n- Create a new Subject (/wp-admin/admin.php?page=sch-subject), with the following payload in the Subject Name field: \" autofocus onfocus=alert(/XSS/)//\nThe XSS will be triggered when editing the Subject\n\n- Create a new Exam (/wp-admin/admin.php?page=sch-exams) with the following payload in the Exam Name Field: \" autofocus onfocus=alert(/XSS/)//\nThe XSS will be triggered when editing the Exam=20\n\nNote that some of this XSS issues can be executed by a teacher (medium-privileged user), but since wordpress uses HTTPonly cookies is impossible to steal cookies.\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:09.469125Z"}