Backup and Staging by WP Time Capsule < 1.22.7 – Reflected Cross-Site Scripting | CVE 2021-25035 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape the error parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

Proof of Concept

Once the "Server Requirements" are passed in the initial setup process (you can bypass the check for localhosts by editing the is_localhost function in the same file for testing purpose) the vulnerability can be triggered at any time in an admin's panel using an URI with JavaScript content inserted in the error parameter such as :

https://example.com/wp-admin/admin.php?page=wp-time-capsule&error="><script>alert(/XSS/)</script>&cloud_auth_action=g_drive

Affects Plugins

wp-time-capsule

Fixed in 1.22.7

References

CVE

URL

https://plugins.trac.wordpress.org/changeset/2641264

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Jeremie Amsellem

Submitter

Jeremie Amsellem

Submitter website

https://fenrir.pro

Submitter twitter

Verified

Yes

WPVDB ID

f426360e-5ba0-4d6b-bfd4-61bc54be3469

Timeline

Publicly Published

2021-12-21 (about 4 years ago)

Added

2021-12-21 (about 4 years ago)

Last Updated

2022-04-13 (about 3 years ago)

Other

Published

Title

Published

2024-01-31

Title

Starbox < 3.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Display Name and Social Settings

Published

2024-06-06

Title

Block for Font Awesome < 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-12-22

Title

WP Mailster < 1.8.18.0 - Reflected Cross-Site Scripting

Published

2014-08-01

Title

scarlet <= 1.1.3 - XSS in ZeroClipboard.swf

Published

2025-10-03

Title

Trinity Audio < 5.21.0 - Reflected Cross-Site Scripting