Widget Bundle <= 2.0.0 - Unauthencated Reflected XSS

2024-05-3100:00:00

Bob Matyas

wpscan.com

widget bundle plugin

unauthenticated users

reflected cross-site scripting

user login/registration widget

6 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users

PoC

On a site with the User Login/Registration widget active, have an unauthenticated user send a post request to the any page where the widget appears: