Description

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-19T06:17:39.363Z",
  "pubdate": "2026-08-19T06:17:39.363Z",
  "executiveSummary": "A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the ProSolution WP Client WordPress plugin prior to version 2.0.11. The flaw stems from insufficient sanitisation and output escaping of a user-supplied parameter before it is dynamically reflected into an HTML attribute within an administrative page. The primary impact of this vulnerability is the execution of arbitrary JavaScript code within the active browser session of an authenticated administrator.\nThe affected product is the ProSolution WP Client WordPress plugin. Risk implications include potential session hijacking, unauthorized administrative actions, and further compromise of the underlying WordPress installation. Attacker capabilities rely on the ability to craft malicious requests and induce a privileged administrator to submit them, typically via social engineering vectors such as phishing links.\nExploitation requirements dictate that a target administrator must be authenticated and actively tricked into interacting with a specially crafted URL containing the malicious payload. The vulnerability exposes the administrative interface to malicious script execution, bridging the trust boundary between the user agent and the web application.",
  "technicalDetails": "The root cause of the vulnerability resides in the improper handling of user-supplied input within the administrative codebase of the ProSolution WP Client WordPress plugin. Specifically, the application accepts a parameter via HTTP request parameters and subsequently reflects this data directly into an HTML attribute on an administrative page without applying proper context-aware sanitisation or output escaping routines.\nThe vulnerable component consists of the administrative routing and rendering logic responsible for generating the specific admin page containing the unsanitized parameter reflection. Affected versions encompass all releases of the ProSolution WP Client WordPress plugin prior to version 2.0.11.\nFrom an authentication and privilege perspective, the vulnerability requires the victim to possess administrative privileges and an active session, as the vulnerable endpoint resides within the administrative interface. Network exposure is standard web-based accessibility over HTTP or HTTPS, typically reachable by any authenticated administrator or via cross-site context if administrative restrictions are bypassed.\nThe step-by-step attack flow proceeds as follows: First, an attacker crafts a malicious URL targeting the vulnerable administrative page of the ProSolution WP Client WordPress plugin, injecting arbitrary JavaScript payloads into the unescaped parameter. Second, the attacker induces an authenticated administrator to click or submit the crafted request through social engineering methods. Third, the WordPress server processes the request and reflects the unsanitized input directly into the HTML attribute of the response page. Fourth, the victim's web browser receives the response, parses the injected payload as executable script code rather than static attribute data, and executes the script within the security context of the administrator's active session.\nThe payload behavior involves executing arbitrary JavaScript in the browser of the administrative user. Post-exploitation impact includes the ability to perform privileged actions on behalf of the administrator, such as creating new rogue administrative accounts, modifying plugin configurations, injecting persistent backdoors into the WordPress theme or core files, or exfiltrating sensitive session cookies and data."
}