Multiple plugins by vcita - Contributor+ Stored Cross-Site Scripting

2023-06-0200:00:00

wpscan.com

vcita plugins

cross-site scripting

email field

contributor role

web scripts

administrators

security vulnerability

0.004 Low

EPSS

Percentile

73.3%

JSON

The plugin does not sanitize and the email field in the plugin settings, which could allow users with roles as low as contributor to inject arbitrary web scripts in the plugin settings page, which could target high privilege users such as administrators.

PoC

https://example.com/wp-admin/admin.php?page=live-site-parse-vcita-callback&success;=true&first;_name=a-a&last;_name=b&title;=c&confirmation;_token=d&confirmed;=true&engage;_delay=1&implementation;_key=1&email;=a“/>&uid;=a

CPENameOperatorVersion
event-registration-calendar-by-vcitalt1.4.0
paypal-payment-button-by-vcitalt3.10.0

CPE	Name	Operator	Version
	event-registration-calendar-by-vcita	lt	1.4.0
	paypal-payment-button-by-vcita	lt	3.10.0

References

blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita

plugins.trac.wordpress.org/browser/event-registration-calendar-by-vcita/trunk/system/parse_vcita_callback.php#L55

plugins.trac.wordpress.org/browser/paypal-payment-button-by-vcita/trunk/system/parse_vcita_callback.php#L55

0.004 Low

EPSS

Percentile

73.3%

JSON

Related for WPVDB-ID:AF2C461C-D8CE-48E1-B802-092B5F56CFBA