[wp-trac] [WordPress Trac] #49430: Stored XSS on Tutor LMS plugin v1.5.4

[WordPress Trac]

#49430: Stored XSS on Tutor LMS plugin v1.5.4
--------------------------+-----------------------------
 Reporter:  matuhn        |      Owner:  (none)
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  Plugins       |    Version:  5.3.2
 Severity:  normal        |   Keywords:
  Focuses:                |
--------------------------+-----------------------------
 I found a Stored XSS when you create a course (/wordpress/wp-admin/post-
 new.php?post_type=courses) then fill title with payload (For example:
 <svg/onload=alert(document.domain)>)

 [[Image(https://i.imgur.com/KLWkuIP.png)]]

 Then go to the course, XSS will be fire
 (http://192.168.10.138/wordpress/index.php/courses/17/)

 [[Image(https://i.imgur.com/PiZsahy.png)]]

 Any more information contact me via anhkhoafto at gmail.com

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/49430>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform