WordPress Plugin Vulnerabilities

Jock on air now < 5.6.2 - Reflected Cross-Site Scripting

Description

The plugin does not escape the $_SERVER['PHP_SELF'] before outputting it back in an attribute in its settings, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
joan
Fixed in 5.6.2

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
98905487-cc31-4678-966f-75e2c06d3291

Timeline

Publicly Published
2021-08-18 (about 4 years ago)
Added
2021-08-18 (about 4 years ago)
Last Updated
2021-08-18 (about 4 years ago)

Other

Published
Title
Published
2021-11-22
Title
Logo Carousel < 3.4.2 - Contributor+ Stored Cross-Site Scripting
Published
2024-10-31
Title
Elementary Addons <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-08-22
Title
WS Theme Addons <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ws_weather Shortcode
Published
2025-02-23
Title
Countdown Timer < 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2012-07-23
Title
Get Off Malicious Scripts - Cross-Site Scripting (XSS)