WordPress StageShow Plugin Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the StageShow plugin for WordPress, affecting all versions through 9.8.6. The issue arises from the use of remove_query_arg without proper escaping, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts could be executed if a user is tricked into clicking a link that contains the malicious payload.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, an attacker can craft a URL that removes specific query arguments using remove_query_arg, without proper escaping. When a user clicks on this link, the injected script will be executed in their browser.

Remediation

Users are advised to update the StageShow plugin to version 10.0 or later.