Correct Prices WordPress Plugin Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the Correct Prices plugin for WordPress, affecting versions through 1.0. The issue arises in the correct_prices_page() function, which outputs the $_SERVER['PHP_SELF'] variable into a form's action attribute without proper input sanitization or output escaping. This lack of protection allows attackers to inject arbitrary markup by exploiting the PHP_SELF variable, which can reflect attacker-controlled path information. As a result, unauthenticated attackers could inject malicious web scripts into pages, potentially executing them if a user is tricked into clicking a crafted link.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.