Smart Online Order for Clover <= 1.5.7 - Reflected Cross-Site Scripting

Vulnerability

The Smart Online Order for Clover plugin for WordPress versions up to and including 1.5.7 is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability arises from the use of add_query_arg and remove_query_arg functions without proper escaping on the URL, allowing arbitrary script injection. The plugin is available on the WordPress plugin repository and requires a Clover POS and a subscription to the companion marketplace application [1].

Exploitation

An unauthenticated attacker can exploit this vulnerability by crafting a malicious URL containing injected JavaScript. The attacker must trick a user into clicking the link, for example via phishing or social engineering. No authentication or special network position is required; the attack is reflected and executes in the context of the victim's browser session.

Impact

Successful exploitation allows the attacker to inject arbitrary web scripts into pages that the victim views. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The impact is limited to the victim's browser and the privileges of the affected WordPress user.

Mitigation

The plugin developer released version 1.6.1, which presumably addresses the vulnerability. Users should update to version 1.6.1 or later immediately. As of the publication date (2024-10-16), no workaround is documented. The plugin is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.