WordPress Plugin Vulnerabilities

SpeakOut! Email Petitions < 2.13.3 - Reflected Cross-Site Scripting

Description

The plugin does not escape its searchString parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

https://example.com/wp-admin/admin.php?page=dk_speakout_signatures&action=search&searchString="><script>alert(/XSS/)</script>

Affects Plugins

Plugin icon
speakout
Fixed in 2.13.3

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
6df1cd74-34d3-455c-b51f-ba3928a89359

Timeline

Publicly Published
2021-08-09 (about 2 years ago)
Added
2021-08-09 (about 2 years ago)
Last Updated
2021-08-09 (about 2 years ago)

Other

Published
Title
Published
2024-03-13
Title
wp-mpdf < 3.8 - Reflected Cross-Site Scripting
Published
2021-06-21
Title
Browser Screenshots < 1.7.6 - Contributor+ Stored XSS
Published
2024-03-18
Title
MyCurator Content Curation < 3.77 - Reflected Cross-Site Scripting
Published
2023-10-21
Title
WP Adminify < 3.1.6 - Admin+ Stored XSS
Published
2022-09-14
Title
Cryptocurrency Pricing list and Ticker <= 1.5 - Reflected Cross-Site Scripting