Description

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-19T06:17:39.117Z",
  "pubdate": "2026-08-19T06:17:39.117Z",
  "executiveSummary": "An input sanitization and output encoding vulnerability exists in the ProSolution WP Client WordPress plugin before version 2.0.11.\nThe flaw manifests as a Reflected Cross-Site Scripting (XSS) vulnerability, allowing unauthenticated attackers to execute arbitrary client-side scripts within the context of a victim's browser session.\nThe vulnerability impacts public-facing pages of the ProSolution WP Client plugin where user-supplied input parameters are reflected directly into HTML attributes without proper sanitization or context-aware escaping.\nRisk implications include potential session hijacking, credential theft, and unauthorized administrative actions if successfully triggered against privileged users such as logged-in administrators.\nAttackers require the ability to craft malicious URLs containing payload data and trick a target visitor or administrator into navigating to the crafted link over the network.\nNo prior authentication or specific privileges are required to initiate the attack vector against visitors of the public pages.",
  "technicalDetails": "The root cause of the vulnerability stems from the inadequate handling of user-supplied parameters within the ProSolution WP Client WordPress plugin prior to version 2.0.11.\nSpecifically, the application fails to perform input sanitization and context-aware HTML attribute escaping on several parameters before dynamically reflecting them into the Document Object Model (DOM) on public-facing pages.\nBecause the input is rendered directly inside HTML attributes without neutralization of special characters such as double quotes, angle brackets, and event handlers, an attacker can break out of the intended attribute context and inject arbitrary HTML and JavaScript payloads.\nThe attack flow proceeds as follows: First, an attacker identifies the vulnerable parameters exposed on public pages managed by the ProSolution WP Client plugin. Second, the attacker crafts a malicious URL containing a JavaScript payload engineered to execute within the victim's browser. Third, the attacker delivers this crafted link to a target visitor or logged-in administrator via social engineering, phishing, or other distribution channels over the network.\nUpon clicking the link, the victim's browser sends an HTTP request to the vulnerable WordPress site. The ProSolution WP Client plugin processes the request, takes the unsanitized parameter values, and reflects them directly into the HTML response attributes.\nThe victim's browser parses the malicious response, interprets the injected payload as executable script content, and executes it within the security context of the victim's session.\nIf the targeted victim is a logged-in administrator, the payload executes with elevated privileges, potentially allowing the attacker to perform unauthorized actions such as creating new administrative accounts, modifying plugin settings, or deploying further persistence mechanisms within the WordPress installation.\nThe vulnerability is exposed via the network vector and requires no authentication or special privileges to exploit against public page visitors."
}