WordPress Plugin Vulnerabilities

Advanced Ads < 1.17.4 - Reflected XSS via Admin Dashboard

Description

The plugin does not sanitise and escape the advads-last-edited-group before outputting it back in an attribute in n admin page, leading to a Reflected Cross-Site Scripting

Affects Plugins

Plugin icon
advanced-ads
Fixed in 1.17.4

References

URL
https://labs.sucuri.net/reflected-xss-in-advanced-ads-admin-dashboard/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Antony Garand (sucuri.net)
Verified
Yes
WPVDB ID
8553236e-003a-4f7e-96d2-14cf52ad1b99

Timeline

Publicly Published
2020-03-18 (about 6 years ago)
Added
2020-03-18 (about 6 years ago)
Last Updated
2022-02-18 (about 4 years ago)

Other

Published
Title
Published
2022-10-12
Title
5 Anker Connect < 1.2.7 - Reflected Cross-Site Scripting
Published
2024-11-18
Title
Dynamic URL SEO < 1.2 - Reflected XSS
Published
2025-01-15
Title
Social Pug: Author Box <= 1.0.0 - Reflected Cross-Site Scripting
Published
2024-08-22
Title
Gixaw Chat <= 1.0 - Stored XSS via CSRF
Published
2024-10-14
Title
Smart Online Order for Clover < 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via moo_receipt_link Shortcode