PluXml Stored Cross-Site Scripting Vulnerability in Article Comments Feature

A stored cross-site scripting vulnerability has been identified in the PluXml article comments feature, affecting versions through 5.8.22. The issue arises because the application does not properly sanitize user input in the 'link' field of comments. This allows attackers to inject arbitrary JavaScript, which is then stored in the database and executed in the Administration panel's 'Comments' section. While the malicious script does not appear in the public comments interface, it can be directly injected into existing comments by users with Administrator, Moderator, or Manager roles. This vulnerability specifically impacts '/core/admin/comments.php'.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the comments in the administration panel.