WP Athletics <= 1.1.7 - Subscriber+ Stored Cross-Site Scripting

2022-05-1700:00:00

Wejdan Alomari

0.001 Low

EPSS

Percentile

24.8%

JSON

The plugin does not sanitize parameters before storing them in the database, nor does it escape the values when outputting them back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability.

- Log on to the site using a subscriber account.
- On the page the shortcode is rendered, click on "Why not add your own race result?"
- In the "Event Name" field, enter "><img src=x onerror=alert(1)// >, and fill in & submit the rest of the form.
- As an administrator, visit /wp-admin/admin.php?page=wp-athletics-manage-results

0.001 Low

EPSS

Percentile

24.8%

JSON

Related for WPEX-ID:AFEF06F5-71A6-4372-9648-0DB59F9B254F