Description

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. On multisite installations where administrators do not hold the unfiltered_html capability, this vulnerability can be leveraged to target the network super administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-09-19T08:16:51.907Z",
  "pubdate": "2026-09-19T08:16:51.907Z",
  "executiveSummary": "The OTP Login & Register Woocommerce plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 2.7.3. This vulnerability stems from inadequate sanitization and output escaping within the 'fb-config' administrative setting.\nAn authenticated user with administrator-level privileges can inject malicious JavaScript payloads into the plugin configuration. When rendered, these scripts execute within the browser context of any user visiting the affected page, including high-privilege accounts such as network super administrators in multisite environments.\nThe primary risk involves unauthorized execution of arbitrary web scripts, which can lead to session hijacking, administrative action spoofing, or unauthorized redirection. Successful exploitation requires an attacker to possess existing administrative credentials to modify plugin settings, limiting the attack vector to established internal accounts. However, the impact is severe in multisite configurations where the vulnerability serves as a potential escalation point to target the network administrator.",
  "technicalDetails": "The vulnerability resides within the settings management component of the OTP Login & Register Woocommerce plugin. The plugin fails to perform rigorous input validation or secure output encoding on the 'fb-config' parameter when saving or rendering administrative settings.\nThe root cause is identified as improper neutralization of input during the storage process, combined with a lack of output escaping during rendering. Because the 'fb-config' setting is stored directly in the database without sufficient sanitization, the application treats the user-supplied data as trusted content. Consequently, when the plugin administrative panel or related front-end interfaces retrieve these configuration values, the injected payloads are delivered to the browser's document object model (DOM) as executable code rather than plain text.\nThe attack flow proceeds as follows: First, an authenticated attacker with administrator privileges navigates to the plugin settings dashboard. Second, the attacker interacts with the 'fb-config' input field, providing a malicious script payload (e.g., <script>alert('XSS')</script>). Third, the plugin backend saves this payload directly into the WordPress options table without invoking sanitization functions like sanitize_text_field() or esc_attr(). Finally, when an administrator or super administrator views the affected interface, the browser parses the payload as active content, leading to persistent script execution.\nThis vulnerability is particularly significant in WordPress multisite installations. In scenarios where network super administrators are restricted from using the 'unfiltered_html' capability, this flaw allows lower-privileged administrators to bypass those security boundaries by forcing the execution of scripts within the context of the super administrator's active session. The impact includes the potential to modify site configurations, steal session cookies, or capture sensitive administrative traffic through browser-based exfiltration. Because the payload is stored persistently in the database, the cross-site scripting attack will trigger every time the configuration page is loaded, ensuring broad impact across various user roles with access to the dashboard."
}