EUVD-2025-17497CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
3DescriptionNVD
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redqteam Wishlist allows Reflected XSS. This issue affects Wishlist: from n/a through 2.1.0.
AnalysisAI
Reflected Cross-Site Scripting (XSS) vulnerability in redqteam's Wishlist plugin affecting versions up to 2.1.0. An unauthenticated attacker can craft malicious URLs containing unfiltered input that executes arbitrary JavaScript in a victim's browser when clicked, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector requiring user interaction; current KEV/EPSS status and active exploitation details are not provided in available intelligence.
Technical ContextAI
This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic web application flaw where user-supplied input is reflected in HTTP responses without proper encoding or sanitization. The Wishlist plugin, developed by redqteam, fails to sanitize query parameters or form inputs before rendering them in the HTML response. Reflected XSS differs from stored XSS in that the payload is not persisted in a database—instead, it lives in the URL itself, making it suitable for social engineering attacks via email or malicious links. The affected product range (n/a through 2.1.0) suggests no previous patches existed or version tracking began after initial vulnerable code. CPE identification would typically be: cpe:2.3:a:redqteam:wishlist:*:*:*:*:*:*:*:* (version range 0-2.1.0), though exact CPE notation is not provided in the vulnerability source.
RemediationAI
- Immediate: Update redqteam Wishlist plugin to version 2.1.1 or later once released (verify vendor release notes for patch confirmation). 2. Workarounds (if patch unavailable): Implement Web Application Firewall (WAF) rules to block requests containing common XSS payloads (e.g.,
<script>,javascript:,onerror=); enforce Content Security Policy (CSP) headers (Content-Security-Policy: default-src 'self'; script-src 'self') to mitigate reflected XSS impact. 3. Mitigation: Disable the Wishlist plugin on production systems until patched; use an alternative plugin with active security maintenance. 4. Developer patch (if vendor unresponsive): Sanitize all user inputs using appropriate encoding (HTML entity encoding for reflected output,htmlspecialchars()in PHP, or framework equivalents). 5. Monitoring: Audit logs for suspicious query parameters; monitor for signs of session hijacking or unauthorized account access.
Share
External POC / Exploit Code
Leaving vuln.today