WordPress Plugin Vulnerabilities
Shop Page WP < 1.2.8 - Admin+ Stored Cross-Site Scripting
Description
The plugin does not sanitise and escape some of the Product fields, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Proof of Concept
Add/edit a product and put the following payload in the Product Affiliate URL, Custom Button Text fields: "><img src onerror=alert(/XSS/)> The Product Description field is also affected, with the following payload: </textarea><img src onerror=alert(/XSS/)> The XSS will be triggered when viewing the Product in a page, or when editing the Product in the admin dashboard
Affects Plugins
Fixed in version 1.2.8
References
Classification
Miscellaneous
Original Researcher
Mika
Submitter
Mika
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2021-11-01 (about 10 months ago)
Added
2021-11-01 (about 10 months ago)
Last Updated
2022-04-09 (about 5 months ago)