Easy Updates Manager Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the Easy Updates Manager plugin for WordPress, affecting versions through 9.0.20. The issue arises from inadequate input sanitization and output escaping in the 'paged' parameter of the pagination function. This vulnerability allows attackers to inject arbitrary web scripts into pages, which could be executed when an administrator is tricked into clicking a link to the compromised page.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, an attacker can send a request to a WordPress site with the 'paged' parameter set to a value that includes the injected script. If an administrator clicks on the link with the injected 'paged' parameter, the script will execute, demonstrating the cross-site scripting vulnerability.

Remediation

Users are advised to update the Easy Updates Manager plugin to version 9.0.21 or later, where this vulnerability has been patched.