Reflected XSS (CVE-2021-24316)

[pikpikcu]

Describe the bug
Hi Team,
We just found an Mediumish WordPress Theme <= 1.0.47 - Unauthenticated Reflected XSS & XFS in https://blog.gopaddle.io/

To Reproduce
Steps to reproduce the behavior:
1.Open Browser and Go To site: https://blog.gopaddle.io/?post_type=post&s=
2.Inject XSS to param (s), and using payloads: "><script>alert(document.domain)</script>
3.Click Run and then XSS will trigger.

POC
https://blog.gopaddle.io/?post_type=post&s=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E

Screenshots

reference:

• https://wpscan.com/vulnerability/57e27de4-58f5-46aa-9b59-809705733b2e
• https://m0ze.ru/vulnerability/%5B2021-03-14%5D-%5BWordPress%5D-%5BCWE-79%5D-Mediumish-WordPress-Theme-v1.0.47.txt

Impact
As you know, with a reflected XSS, a malicious user could trick a user into browsing to a URL which would trigger the XSS and steal the user's cookie, capture keyboard strokes, etc and eventually take over a user's account.

Regards
pikpikcu