WordPress Plugin Vulnerabilities

Game Server Status <= 1.0 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not escape some of the Game Server data, which could allow high privilege users such as admin to perform Cross-Site Scripting even when the unfiletred_html is disallowed

Proof of Concept

Affects Plugins

Plugin icon
game-server-status
No known fix

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
3.5 (low)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
15c6ef88-c10c-4f3a-a681-ddee399279b5

Timeline

Publicly Published
2021-09-21 (about 4 years ago)
Added
2021-09-21 (about 4 years ago)
Last Updated
2021-09-21 (about 4 years ago)

Other

Published
Title
Published
2019-06-26
Title
Author Chat < 2.0.0 - SQL Injection
Published
2026-03-31
Title
Amelia < 2.1.3 - Authenticated (Manager+) SQL Injection via 'sort' Parameter
Published
2021-08-22
Title
WP Domain Redirect <= 1.0 - Authenticated SQL Injection
Published
2014-08-01
Title
Booking System <= 1.2 - SQL Injection
Published
2026-05-06
Title
BetterDocs Pro < 3.7.1 - Unauthenticated SQL Injection via Encyclopedia 'limit' Parameter