Sync iCloud COS < 2.0.1 - Admin+ Stored Cross-Site Scripting
Description
The Sync QCloud COS WordPress plugin before 2.0.1 does not escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- WordPress/Sync QCloud COS WordPress plugindescription
- Range: <2.0.1
Patches
Vulnerability mechanics
Root cause
"Missing output escaping in plugin settings allows stored Cross-Site Scripting even when unfiltered_html is disallowed."
Attack vector
An attacker with admin-level privileges can inject arbitrary JavaScript into plugin settings that are not properly escaped [ref_id=1]. When other users (including other admins) view the affected settings page, the injected script executes in their browser. This is a stored Cross-Site Scripting (XSS) attack [CWE-79] that bypasses the unfiltered_html capability restriction, meaning the attack works even when WordPress normally prevents administrators from inserting arbitrary HTML/JavaScript [ref_id=1].
Affected code
The Sync QCloud COS WordPress plugin (versions before 2.0.1) does not escape some of its settings [ref_id=1]. The advisory does not specify the exact file paths or function names responsible for the missing escaping.
What the fix does
The advisory states the vulnerability is fixed in version 2.0.1 of the Sync QCloud COS plugin [ref_id=1]. No patch diff is provided in the bundle, but the fix would involve properly escaping the plugin's settings output using WordPress escaping functions (e.g., esc_html() or wp_kses()) to prevent stored XSS. The advisory does not include a patch or further technical details about the remediation.
Preconditions
- authAttacker must have admin-level privileges on the WordPress site
- configThe Sync QCloud COS plugin must be installed and active with a version before 2.0.1
Generated on May 24, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1- wpscan.com/vulnerability/22dc2661-ba64-49e7-af65-892a617ab02cmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.