Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.This issue affects UpSolution Core: from n/a through 8.44.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-10-09T10:16:40.063Z",
  "pubdate": "2026-10-09T10:16:40.063Z",
  "executiveSummary": "The UpSolution Core plugin is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation.\nThis vulnerability allows unauthenticated remote attackers to inject arbitrary malicious scripts into the context of a user's session.\nAffected versions include UpSolution Core from n/a through 8.44.\nThe primary risk involves the execution of unauthorized JavaScript in the victim's browser, which can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the user, or redirection to malicious third-party domains.\nSuccessful exploitation requires an attacker to trick a legitimate user into clicking a crafted link containing the malicious payload, which is then reflected back by the vulnerable component of the plugin.",
  "technicalDetails": "The vulnerability is identified as a Reflected XSS issue within the UpSolution Core product. The root cause is the application's failure to adequately sanitize or encode user-provided input before rendering it in the HTML response. Specifically, the component fails to implement context-aware output escaping, allowing an attacker to break out of the intended HTML tag structure and inject functional JavaScript.\nThe attack flow begins when an attacker crafts a malicious URL containing a specially formatted payload in a parameter handled by the plugin. When a victim, such as an authenticated administrator or regular user, clicks this link, the server processes the input and includes the unescaped script in the resulting HTTP response. The browser, receiving the response, interprets the injected script as legitimate code originating from the trusted origin, thereby executing it within the security context of the user's current session.\nBecause the payload is reflected immediately in the server's response, it does not require persistence in the database. However, the impact is significant: the injected script can access document cookies (if not protected by HttpOnly flags), capture sensitive input data, modify the DOM to present fraudulent forms, or initiate background requests (CSRF) against the WordPress installation with the victim's privileges.\nThe vulnerability affects UpSolution Core versions up to and including 8.44. The exposure is network-based, as any component that improperly handles GET or POST parameters passed to the affected plugin functions creates an entry point for exploitation. There are no specific authentication requirements for the attacker to initiate the reflection, although the impact may be escalated if the victim has elevated privileges.\nPost-exploitation, the attacker maintains control over the victim's browser interactions for the duration of the session. This enables the harvesting of CSRF tokens, session identifiers, or other sensitive authentication state, effectively bypassing standard browser-based protections like the Same-Origin Policy (SOP) regarding script execution within the plugin's context."
}