WordPress Plugin Vulnerabilities

Docket Cache < 21.08.02 - Reflected Cross-Site Scripting

Description

The plugin does not escape some filter parameters (when the OPCache Viewer is enabled) before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

Proof of Concept

Affects Plugins

Plugin icon
docket-cache
Fixed in 21.08.02

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
567dcc86-abdf-4866-8503-100ad9cfe53e

Timeline

Publicly Published
2021-08-30 (about 4 years ago)
Added
2021-08-30 (about 4 years ago)
Last Updated
2021-08-30 (about 4 years ago)

Other

Published
Title
Published
2024-03-18
Title
MJM Clinic < 1.1.23 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2023-02-22
Title
Top 10 < 3.2.5 - Admin+ Stored XSS
Published
2024-10-09
Title
Elementor Inline SVG <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Published
2024-11-08
Title
WoW Guild Armory Roster <= 0.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2022-06-06
Title
miniOrange's Malware Scanner < 4.5.2 - Admin+ Stored Cross-Site Scripting