CVE-2024-6536 PoC — Zephyr Project Manager < 3.3.99 - Editor+ XSS

Source

https://github.com/apena-ba/CVE-2024-6536

Associated Vulnerability

Title:Zephyr Project Manager < 3.3.99 - Editor+ XSS (CVE-2024-6536)
Description:The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Readme

## Description

This script is a PoC for CVE-2024-6536, where a XSS is possible in the Zephyr Project Manager plugin for Wordpress. It requires authentication and privileges as a project manager administrator.

## Usage

```python3 CVE-2024-6536.py -u <USERNAME> -p <PASSWORD> -w <url>```

Example: ```python3 CVE-2024-6536.py -u user -p user -w http://localhost/wordpress```

## Links
- https://wpscan.com/vulnerability/ee40c1c6-4186-4b97-866c-fb0e76cedeb8/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-6536

File Snapshot


 [4.0K]  /data/pocs/f9edd4eab9c8c16c81a4a28941e56c0d8133444e
├── [3.5K]  CVE-2024-6536.py
└── [ 518]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!