Quotes llama < 1.0.0 – Admin+ Stored Cross-Site Scripting | CVE 2022-1566

Description

The plugin does not sanitise and escape Quotes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. The attack could also be performed by tricking an admin to import a malicious CSV file

Proof of Concept

Create/edit a quote and put the following payload in the Quote field: <script>alert(/XSS/)</script>, and '><script>alert(/XSS-img/)</script> in the Image URL one

Also works when importing quotes via CSV:

quote|first_name|last_name|source|img_url
<script>alert(/XSS-quote/)</script>|John|Smith|'><script>alert(/XSS-img/)</script>|

The XSS will be triggered in the Quotes List page