W4 Post List < 2.4.6 - Reflected XSS

The plugin does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting

PoC

Make a logged in admin open https://example.com/wp-admin/edit.php?post_type=w4pl&amp;page;=w4pl-docs&amp;a;“> On a page where there is a list with navigation displayed (put a [nav] in the template of the list) output, append the following payload: a”>, example: https://example.com/list/w4-post-list-1/?a">