Greenmart < 2.4.3 - Reflected Cross-Site Scripting (XSS)

The greenmart_autocomplete_search AJAX action, available to both authenticated and unauthenticated users does not properly sanitise the callback parameter passed to it, resulting in a reflected Cross-Site Scripting issue. Edit (WPScanTeam): The vendor ‘fixed’ the issue for authenticated users by adding a nonce rather than escaping the callback parameter. However, the issue still remains for unauthenticated users, the vendor has been notified via Envato and another advisory will be released with the details once fixed.

PoC

http://localhost/wp-admin/admin-ajax.php?callback=-->'"><svg/onload=alert(/XSS/)>&amp;action;=greenmart_autocomplete_search&amp;term;=defaultText