WordPress Plugin Vulnerabilities

Flexi - Guest Submit < 4.20 - Reflected Cross-Site Scripting

Description

The plugin does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting

Proof of Concept

Affects Plugins

Plugin icon
flexi
Fixed in 4.20

References

CVE
CVE-2022-0449

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Felipe Tapia Sasot
Submitter
Felipe Tapia Sasot
Submitter twitter
wyldgoat
Verified
Yes
WPVDB ID
3cc1bb3c-e124-43d3-bc84-a493561a1387

Timeline

Publicly Published
2022-02-16 (about 3 years ago)
Added
2022-02-16 (about 3 years ago)
Last Updated
2022-04-08 (about 3 years ago)

Other

Published
Title
Published
2024-04-10
Title
Popup Like box – Page < 3.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2012-08-08
Title
Mini Mail Dashboard Widget 1.42 - Message Body XSS
Published
2025-02-22
Title
SMTP for SendGrid – YaySMTP < 1.5 - Unauthenticated Stored Cross-Site Scripting via Email Logs
Published
2024-04-05
Title
Powerkit – Supercharge your WordPress Site < 2.9.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2024-09-13
Title
Waitlist Woocommerce ( Back in stock notifier ) < 2.7.6 - Reflected Cross-Site Scripting