Vulnerability: The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title.
Vulnerability ID: CVE-2016-10969
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/SupportFlow/supportflow
Published: 2019-09-16
File: classes/class-supportflow-admin.php
Commit message: Admin: Escape ticket title on Discussion screen to avoid XSS.

If `run_wptexturize` is disabled, the following subject title would allow an attacker to perform cross-site scripting:

`"><script>alert('hi');</script>`

That attack has a CVSS score of 4.7 - https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

The rest of the output was reformatted to improve readability and make it easier to spot missing escaping functions or other problems.

Props https://hackerone.com/whitehatter for discovering and disclosing responsibly.

Fixes https://hackerone.com/reports/145086
Commit author: Ian Dunn

Vulnerable version (before fix):
 public function render_meta_box_details_actions() { 	 * A box that appears at the top 	 */ 	public function meta_box_subject() {  		$placeholder = __( 'What is your conversation about?', 'supportflow' ); 		echo '<h4>' . __( 'Subject', 'supportflow' ) . '</h4>'; 		echo '<input type="text" id="subject" name="post_title" class="sf_autosave" placeholder="' . $placeholder . '" value="' . get_the_title() . '" autocomplete="off" />'; 		echo '<p class="description">' . __( 'Please describe what this ticket is about in several words', 'supportflow' ) . '</p>';  	}  	/**

Fixed version (after fix):
 public function render_meta_box_details_actions() { 	 * A box that appears at the top 	 */ 	public function meta_box_subject() { 		?>  		<h4><?php _e( 'Subject', 'supportflow' ); ?></h4>  		<input 			type="text" 			id="subject" 			name="post_title" 			class="sf_autosave" 			placeholder="<?php _e( 'What is your conversation about?', 'supportflow' ); ?>" 			value="<?php echo esc_attr( get_the_title() ); ?>" 			autocomplete="off" 		/>  		<p class="description"> 			<?php _e( 'Please describe what this ticket is about in several words', 'supportflow' ) ?> 		</p>  		<?php 	}  	/**

Patch:
patch: @@ -899,12 +899,25 @@ public function render_meta_box_details_actions() {
 	 * A box that appears at the top
 	 */
 	public function meta_box_subject() {
+		?>
+
+		<h4><?php _e( 'Subject', 'supportflow' ); ?></h4>
 
-		$placeholder = __( 'What is your conversation about?', 'supportflow' );
-		echo '<h4>' . __( 'Subject', 'supportflow' ) . '</h4>';
-		echo '<input type="text" id="subject" name="post_title" class="sf_autosave" placeholder="' . $placeholder . '" value="' . get_the_title() . '" autocomplete="off" />';
-		echo '<p class="description">' . __( 'Please describe what this ticket is about in several words', 'supportflow' ) . '</p>';
+		<input
+			type="text"
+			id="subject"
+			name="post_title"
+			class="sf_autosave"
+			placeholder="<?php _e( 'What is your conversation about?', 'supportflow' ); ?>"
+			value="<?php echo esc_attr( get_the_title() ); ?>"
+			autocomplete="off"
+		/>
 
+		<p class="description">
+			<?php _e( 'Please describe what this ticket is about in several words', 'supportflow' ) ?>
+		</p>
+
+		<?php
 	}
 
 	/**
path: classes/class-supportflow-admin.php