Custom Community < 2.0.25 - Stored Cross-Site Scripting (XSS)

Description

An AJAX action named ‘cc2_advanced_settings_save’ is registered both with and without the ‘nopriv’ prefix. This allows anonymous execution of this AJAX action. The ‘settings[custom_css]’ form field accepts user input, without encoding or validation. This input is then output on every page on the front-end of the site, so long as the Theme is active. This allows for a site-wide, Persistent XSS attack.