Better WordPress Google XML Sitemaps <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting

2022-02-1600:00:00

Krzysztof Zając

0.001 Low

EPSS

Percentile

45.9%

JSON

The plugin does not sanitise and escape its logs when outputting them in the admin dashboard, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins

With the permalinks settings set to plain, as an unauthenticated user, open http://example.com/?bwpsitemap=%3Cimg%20src%20onerror=alert(/XSS/)%3E

The XSS will be triggered in the log dashboard of the plugin https://example.com/wp-admin/admin.php?page=bwp_gxs_stats

0.001 Low

EPSS

Percentile

45.9%

JSON

Related for WPEX-ID:C73316D2-AE6A-42DB-935B-B8B03A7E4363