NewStatPress <= 1.0.4 - Reflected Cross-Site Scripting (XSS)
The NewStatPress plugin utilizes on lines 28 and 31 of the file ‘includes/nsp_search.php’ several variables from the $_GET scope, without sanitation. While WordPress automatically escapes quotes on this scope, the outputs on these lines are outside of quotes, and as such can be utilized to trigger a Reflected XSS attack.
|Proof of Concept||
fixed in version 1.0.6
|OWASP Top 10||A3: Cross-Site Scripting (XSS)|
|Publicly Published||2015-07-07 (about 4 years ago)|
|Added||2015-07-07 (about 4 years ago)|
|Last Updated||2015-07-07 (about 4 years ago)|