Convoworks WP - Reflected cross-site scripting (XSS)

Summary

Name	Convoworks WP 0.22.4 - Reflected cross-site scripting (XSS)
Code name	skims-0030
Product	Convoworks WP
Affected versions	Version 0.22.4
State	Private
Release date	2025-03-14

Vulnerability

Kind	Reflected cross-site scripting (XSS)
Rule	Reflected cross-site scripting (XSS)
Remote	No
CVSSv4 Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:U
CVSSv4 Base Score	4.8 (Medium)
Exploit available	No
CVE ID(s)	CVE-2025-31305

Description

Convoworks WP 0.22.4 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/resources/views/request-log/table_ list.php.

Vulnerability

Skims by Fluid Attacks discovered a Reflected cross-site scripting (XSS) in Convoworks WP 0.22.4. The following is the output of the tool:

Skims output

 314 | $wpConvoServiceConversationRequestDao = $container->get('wpConvoServiceConversationRequestDao');
 315 |
 316 | $requestLogsTable = new ConvoServiceConversationRequestLogTable($wpConvoServiceConversationRequestDao);
 317 | $requestLogsTable->prepare_items();
 318 |
 319 | echo '<div class=""wrap""><h1 class=""wp-heading-inline"">'.print_r($requestLogsTable->get_args(), true).'</h1>';
 320 | ?>
 321 | <form method=""get"">
> 322 | <input type=""hidden"" name=""page"" value=""<?php echo $_REQUEST['page'] ?>"" />
 323 | <?php $requestLogsTable->search_box('search', 'convo_request_log_search'); ?>
 324 | <?php $requestLogsTable->display(); ?>
 325 | </form>
 326 | <div class=""position-fixed bottom-0 right-0 p-3"" style=""z-index: 5; right: 0; bottom: 0;"">
 327 | <div id=""liveToast"" class=""toast hide"" role=""alert"" aria-live=""assertive"" aria-atomic=""true"" data-delay=""2000"">
 328 | <div class=""toast-body"">
 329 | Copied to clipboard.
 330 | </div>
      ^ Col 0

Our security policy

We have reserved the ID CVE-2025-31305 to refer to this issue from now on.

• https://fluidattacks.com/advisories/policy/

System Information

• Product: Convoworks WP
• Version: 0.22.4

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Andres Roldan from Fluid Attacks' Offensive Team using Skims

Timeline