摘要

The WordPress plugin “Advance WP Query Search Filter” contains a reflected Cross-Site Scripting (XSS) vulnerability that allows an attacker to inject JavaScript via crafted input parameters. Successful exploitation can lead to session theft, malicious redirects, or client-side payload execution in the context of a victim’s browser.

技術細節

The vulnerability is reflected XSS: user-controlled input reaches output rendering without proper sanitisation or output encoding. Commonly affected entry points are query parameters used to build search results, filter labels, or shortcodes that echo request data directly into HTML.

Typical vulnerable pattern

<?php
// vulnerable: direct echo of request parameter into page
echo '<div class="filter-label">' . $_GET['filter_label'] . '</div>';
?>

Simple exploit example (reflected)

Accessing a URL such as:

https://example.com/?filter_label=<script></script>

If the application echoes the parameter without encoding, the script runs in the visitor’s browser.

影響

• Session token theft and account takeover risks for administrative users.
• Malicious JavaScript execution leading to data exfiltration, UI redress, or fraudulent actions.
• Reputational damage and potential regulatory exposure for organisations operating in Hong Kong and the region.

偵測

Look for signs of exploitation and search for code patterns that echo unsanitised inputs.

• Review server logs and access logs for suspicious query parameters containing “
  查看我的訂單

  0

  小計

  稅金和運費在結帳時計算

  結帳