WP Ticket < 5.10.4 – Admin+ Stored Cross-Site Scripting | CVE 2021-24622 | Plugin Vulnerabilities

Description

The plugin does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Proof of Concept

Navigate to WP Ticket > Forms >  edit layout of "Open a Ticket" or "Search Tickets" > on "Editing Form" Setting menu.

Select a form field and you can edit the "Label" with a cross-site scripting (XSS) payload such as
v < 5.10.3 - "><script>alert(/XSS/)</script> 
v <= 5.10.3 - " style=animation-name:rotation onanimationstart=alert(/XSS/)//

All of the parameters on the "Editing Form" are vulnerable.

To trigger the XSS payload, refresh the "Editing Form" page.

Affects Plugins

Fixed in 5.10.4

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Tri Wanda Septian

Submitter

Tri Wanda Septian

Submitter website

https://twseptian.github.io/

Submitter twitter

Verified

Yes

WPVDB ID

41a2c72c-7db1-473a-8844-47f6ae9d0594

Timeline

Publicly Published

2021-09-20 (about 4 years ago)

Added

2021-09-20 (about 4 years ago)

Last Updated

2022-04-08 (about 3 years ago)

Other

Published

Title

Published

2024-10-09

Title

Maximum Products per User for WooCommerce < 4.2.9 - Reflected Cross-Site Scripting

Published

2020-06-19

Title

Travel Booking < 2.8.2 - Unauthenticated Reflected XSS

Published

2024-07-29

Title

SmartSearch WP <= 2.4.4 - Unauthenticated Stored XSS

Published

2025-10-02

Title

AP Background <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2016-04-12

Title

WPSOLR <= 8.6 - Unauthenticated Reflected Cross-Site Scripting (XSS)