✍️ Description

section parameter at Line 331 of email-templates.php sends unvalidated data to a web browser, which can result in the browser executing malicious code.

In this case the data is sent at builtin_echo() in email-templates.php at line 331

🕵️‍♂️ Proof of Concept

Data enters in application through an untrusted source.

$section = ( !empty( $_GET['section'] ) ) ? $_GET['section'] : $_POST['section'];

The data is included in dynamic content that is sent to a web user without being validated.

<input type="hidden" name="section" value="<?php echo $section; ?>">

Providing payload as: section="><script>alert(1)</script> will result into XSS.

💥 Impact

The malicious content sent to the web browser often takes the form of a segment of JavaScript, but may also include HTML, Flash or any other type of code that the browser may execute. The variety of attacks based on XSS is almost limitless, but they commonly include transmitting private data like cookies or other session information to the attacker, redirecting the victim to web content controlled by the attacker, or performing other malicious operations on the user's machine under the guise of the vulnerable site.