SponsorMe WordPress Plugin Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the SponsorMe plugin for WordPress, affecting all versions through 0.5.2. The issue arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts could be executed if a user is tricked into clicking a link. The vulnerability exploits the PHP_SELF parameter, which is reflected in both a form action attribute and an anchor href attribute. Attackers can append a crafted payload to the wp-admin/admin.php URL path to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, append a crafted payload to the wp-admin/admin.php URL path. The injected script will be reflected in a form action attribute and an anchor href attribute, allowing it to be executed when a user clicks the link.

Remediation

No known patch is available. It is recommended to uninstall the affected plugin and find a replacement.