Executive brief
Powie's WHOIS Domain Check is a WordPress plugin used to check domain availability. A security flaw in the plugin's settings page allows an authenticated user to inject malicious scripts. If an administrator views these settings, the attacker could potentially take over the website or gain higher-level administrative privileges.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Powie's WHOIS Domain Check plugin for WordPress (version 0.9.31 and earlier). The vulnerability is located in the pwhois_settings.php configuration page, where multiple input fields—including 'display-on-free', 'display-on-connect', and 'before-whois-output'—fail to sanitize user-supplied data before echoing it back to the page. An authenticated attacker with access to plugin settings can inject malicious payloads via textarea or input elements. When an administrator subsequently visits the settings page, the arbitrary JavaScript executes in their session context, potentially leading to privilege escalation or site takeover. The issue was addressed in version 0.9.32.
Affected products
- Powie WHOIS Domain Check <= 0.9.31
Timeline
- 2020-06-14: other: Version 0.9.31 released
- 2020-07-07: disclosed: Vulnerability discovered and exploit authored by mqt
- 2020-07-09: other: Exploit published on Exploit-DB
- 2020-07-15: patched: Security fix released in version 0.9.32
- 2026-05-13: advisory: NVD/VulnCheck advisory published