CODEC Sponsored Content - Reflected cross-site scripting (XSS)

Summary

Name	CODEC Sponsored Content 3.0. - Reflected cross-site scripting (XSS)
Code name	skims-0026
Product	CODEC Sponsored Content
Affected versions	Version 3.0.
State	Private
Release date	2025-03-14

Vulnerability

Kind	Reflected cross-site scripting (XSS)
Rule	Reflected cross-site scripting (XSS)
Remote	No
CVSSv4 Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:U
CVSSv4 Base Score	4.8 (Medium)
Exploit available	No
CVE ID(s)	CVE-2025-31302

Description

CODEC Sponsored Content 3.0. was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/codec-sponsored-content.php.

Vulnerability

Skims by Fluid Attacks discovered a Reflected cross-site scripting (XSS) in CODEC Sponsored Content 3.0.. The following is the output of the tool:

Skims output

 134 | function cppp_auto_widget_enable(){
 135 | $units = $_POST['units'];
 136 | if(isset($units)){
 137 | update_option('cppp_auto_widget_units', $units);
 138 | $us = get_option('cppp_publisher_id');
 139 | if($us) {
 140 | $units = str_replace('u','', $units);
 141 | $url = 'https://admin.codecprime.com/update_wp_widget_count/' . $us . '/' . $units . '/horizontal';
 142 | $ch = curl_init();
 143 | curl_setopt($ch, CURLOPT_URL, $url);
 144 | curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 145 | $resp = curl_exec($ch);
 146 |
 147 | if ($resp === false) {
 148 | echo 'cURL error: ' . curl_error($ch);
 149 | wp_die();
 150 | }
 151 | curl_close($ch);
 152 | }
 153 |
 154 | }
> 155 |     echo $units;
  156 |     wp_die();
  157 | }
      ^ Col 0

Our security policy

We have reserved the ID CVE-2025-31302 to refer to this issue from now on.

• https://fluidattacks.com/advisories/policy/

System Information

• Product: CODEC Sponsored Content
• Version: 3.0.

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Andres Roldan from Fluid Attacks' Offensive Team using Skims

Timeline