Reflected Cross-Site Scripting Vulnerability in WP Quick FrontEnd Editor Plugin by WordPress

CVE-2021-4363

Summary

The WP Quick FrontEnd Editor plugin for WordPress is susceptible to a Reflected Cross-Site Scripting vulnerability found in versions up to and including 5.5. This issue arises from inadequate input sanitization and output escaping on the 'save_content_front' function, particularly due to the direct usage of print_r on user-supplied $_REQUEST values. As a result, unauthenticated attackers could exploit this flaw to inject arbitrary web scripts into pages. These malicious scripts could be executed in the context of the user's session if they are tricked into clicking on a deceptive link, posing significant risks to user data and website integrity.

References