A reflected cross-site scripting (XSS) vulnerability in the WordPress plugin duoFAQ credited to be discovered by p7e4 is described by Wordfence this way:

The duoFAQ – Responsive, Flat, Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/duogeek/duogeek-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.8.

If you try to access that file directly, though, it will hit an error before the relevant code is run, so it is unclear if this was really checked over.

What we found was that this could be exploited through the plugin’s admin page.

The plugin registers its admin page to be accessible by Administrators:

348

add_menu_page(__('DuoGeek', 'dp'), __('DuoGeek', 'dp'), 'manage_options', DUO_PANEL_SLUG, array($this, 'duogeek_panel_cb'), '', $this->menuPos);

The function that is called by that, duogeek_panel_cb(), will output the value of GET or POST input “msg” without escaping it (that is also true of the input “duoaction”):

353

public function duogeek_panel_cb() {

389

			<div id="message" class="<?php echo isset( $_REQUEST['duoaction'] ) ? $_REQUEST['duoaction'] : 'updated' ?> below-h2"><p><?php echo str_replace( '+', ' ', $_REQUEST['msg'] ) ?></p></div>

Our Plugin Security Checker had already warned about the possibility of this vulnerability and other instances of the issue.

Proof of Concept

The following proof of concept will cause any available cookies to be shown in an alert box. In Safari and other web browsers that provide XSS filtering this proof of concept will not work.

Replace “[path to WordPress]” with the location of WordPress.

http://[path to WordPress]/wp-admin/admin.php?page=duogeek-panel&msg="><script>alert(document.cookie);</script>