ReactPress vulnerabilities

The ReactPress – Create React App for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to and including 3.4.0 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page. This is possible because the permalink parameter is only passed through sanitize_url(), which does not prevent fetching attacker-controlled remote URLs whose response body is written verbatim to disk via file_put_contents().

ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.

Broken Access Control vulnerability in ReactPress versions up to 3.4.0, exploitable by a user with Subscriber role.