Description
The Sign-up Sheets WordPress plugin before 2.2.13 does not escape some generated URLs, as well as the $_SERVER['REQUEST_URI'] parameter before outputting them back in attributes, which could lead to Reflected Cross-Site Scripting.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Sign-up Sheets | < 2.2.13 | 2.2.13 |
References
- https://wpscan.com/vulnerability/f3526320-3abd-4ddb-8f73-778741bd9c48/ exploit vdb-entry technical-description