WordPress Plugin Vulnerabilities

Edit Comments <= 0.3 - Reflected Cross-Site Scripting

Description

The plugin does not sanitise, validate or escape the jal_edit_comments GET parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
edit-comments
No known fix

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
3d90060b-4e40-4f39-98b7-02a8eb8cb0cf

Timeline

Publicly Published
2021-07-24 (about 4 years ago)
Added
2021-07-24 (about 4 years ago)
Last Updated
2021-07-24 (about 4 years ago)

Other

Published
Title
Published
2022-12-22
Title
Carousel, Slider, Gallery by WP Carousel < 2.5.3 - Contributor+ Stored XSS
Published
2022-04-26
Title
Turn off all comments <= 1.0 - Reflected Cross-Site Scripting
Published
2024-05-30
Title
Happy Addons for Elementor < 3.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation Widget
Published
2025-09-22
Title
WP Proposals <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-01-22
Title
Grand Magazine < 3.5.8 - Reflected Cross-Site Scripting