Executive brief
The EntreDroppers plugin for WordPress is vulnerable to a security flaw that allows attackers to run malicious scripts in a user's browser. This occurs when a user is tricked into clicking a specially crafted link, potentially leading to unauthorized actions or data theft within the context of the affected website. The issue affects all versions of the plugin up to and including 1.1.2.
Technical details
The EntreDroppers plugin for WordPress suffers from a Reflected Cross-Site Scripting (XSS) vulnerability due to insufficient input sanitization and output escaping of the PHP_SELF superglobal. An unauthenticated attacker can exploit this by crafting a URL containing malicious JavaScript in the path information, which is then reflected into a form action attribute on the page. Execution occurs when a victim, such as an administrator, visits the malicious link. This vulnerability is present in all versions up to and including 1.1.2. Security researchers identified the root cause in the EntreDroppers.php file where PHP_SELF is used without proper neutralization.
Affected products
- owencutajar EntreDroppers <= 1.1.2
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory