Comment Pub - Reflected cross-site scripting (XSS)

Summary

Name	Comment Pub 1.0.0 - Reflected cross-site scripting (XSS)
Code name	skims-0062
Product	Comment Pub
Affected versions	Version 1.0.0
State	Private
Release date	2025-03-14

Vulnerability

Kind	Reflected cross-site scripting (XSS)
Rule	Reflected cross-site scripting (XSS)
Remote	No
CVSSv4 Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:U
CVSSv4 Base Score	4.8 (Medium)
Exploit available	No
CVE ID(s)	CVE-2025-31322

Description

Comment Pub 1.0.0 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/comments_pub_sorting.php.

Vulnerability

Skims by Fluid Attacks discovered a Reflected cross-site scripting (XSS) in Comment Pub 1.0.0. The following is the output of the tool:

Skims output

 677 | echo apply_filters( 'comment_status_links', $status_links );
 678 |
 679 | ?>
 680 |
 681 | <!-- Forms are NOT created automatically, so you need to wrap the table in one to use features like bulk actions -->
 682 | <form id=""comment-filter"" method=""GET"">
 683 |
 684 | <!-- For plugins, we also need to ensure that the form posts back to our current page -->
> 685 | <input type=""hidden"" name=""page"" value=""<?php echo $_REQUEST['page'] ?>"" />
 686 |
 687 | <?php $wp_comment_table->search_box( __( 'Search Comment Pub' ), 'comment_pub' ); ?>
 688 |
 689 | <input type=""hidden"" name=""comment_status"" value=""<?php if( $comment_status == ''){ $comment_status = 'all';
 690 | <input type=""hidden"" name=""pagegen_timestamp"" value=""<?php echo esc_attr(current_time('mysql', 1)); ?>"" />
 691 |
 692 | <?php if ( isset($_REQUEST['paged']) ) { ?>
 693 | <input type=""hidden"" name=""paged"" value=""<?php echo esc_attr( absint( $_REQUEST['paged'] ) ); ?>"" />
      ^ Col 0

Our security policy

We have reserved the ID CVE-2025-31322 to refer to this issue from now on.

• https://fluidattacks.com/advisories/policy/

System Information

• Product: Comment Pub
• Version: 1.0.0

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Andres Roldan from Fluid Attacks' Offensive Team using Skims

Timeline