WordPress Plugin Vulnerabilities

WPtouch < 4.3.44 - Reflected Cross-Site Scripting

Description

The plugin does not escape an URL before outputting it back in an attribute, leading to Reflected Cross-Site Scripting

Proof of Concept

Affects Plugins

Plugin icon
wptouch
Fixed in 4.3.44

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
WPScan
Verified
Yes
WPVDB ID
7dbd8348-9c5d-4d62-a0f4-2b7c2b7e58e4

Timeline

Publicly Published
2022-08-29 (about 3 years ago)
Added
2022-08-29 (about 3 years ago)
Last Updated
2022-08-29 (about 3 years ago)

Other

Published
Title
Published
2024-12-13
Title
States Map US <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-02-24
Title
SVG Support < 2.5.9 - Stored Cross-Site Scripting via Vulnerability Dependency
Published
2024-03-22
Title
Custom WooCommerce Checkout Fields Editor < 1.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2024-11-20
Title
Branda – White Label & Branding, Custom Login Page Customizer < 3.4.22 - Reflected Cross-Site Scripting
Published
2022-09-01
Title
Word Search Puzzles Game <= 2.0.1 - Author+ Stored Cross-Site Scripting