Qwizcards WordPress Plugin Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the Qwizcards WordPress plugin, affecting versions through 3.9.4. The issue arises because the plugin fails to properly sanitize and escape the 'theme_stylesheet' parameter before displaying it on the page. This vulnerability could be exploited against users with high privileges, such as administrators.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to 'qwiz_admin_sample_buttons.php' within the Qwizcards plugin directory. Include a 'theme_stylesheet' parameter with a script payload, such as a JavaScript alert. When the user opens the crafted URL, the injected script will execute, demonstrating the cross-site scripting vulnerability.