OAuth Client by DigitialPixies

OAuth Client by DigitialPixies <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting (XSS)

REPORT ID: fea35a4a-35f4-4da9-b36d-782855f88d62

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated attackers with a role as low as administrator to inject arbitrary web scripts.

References

Source Code: https://wordpress.org/plugins/dpt-oauth-client/

CVE: CVE-2022-3631

Attributes

Catgory: WordPress Plugin

Vulnerability Discovered: 2022-10-10

Report Published: 2022-10-21

Affected Version: <= 1.1.0

Classification

Type: Cross-Site Scripting (XSS)

Researcher

Name: István Márton

Email: [email protected]

Support Us?

We would truly appreciate it if you bought us a bunny (food for a snow leopard).