WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting

2022-01-2600:00:00

Felipe de Avila

214

wordpress

csv importer

stored xss

security vulnerability

admin+.

EPSS

0.001

Percentile

31.5%

JSON

The plugin does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues

Import the following CSV (as comment):

comment_post_ID,comment_author,comment_content,comment_rating,comment_approved,user_id
1,admin,malicious<script>alert(/XSS/)</script>,5,1,admin

Then the XSS will be triggered in the post the comment has been imported (comment_post_ID)

References

plugins.trac.wordpress.org/changeset/2662897

EPSS

0.001

Percentile

31.5%

JSON

Related for WPEX-ID:D718B993-4DE5-499C-84C9-69801396F51F