Reflected cross-site scripting attack possible through error manipulation.

Greetings.
Probing one of our websites, running Newspaper 12.6.5 with WordPress 6.4.3, we have found that there is a security vulnerability related to requests to wp-admin/admin-ajax.php with a td_ajax_loop action in which the property moduleId is altered with malicious content.

This vulnerability has seemingly been reported previously as CVE-2022-2627, but the report mentions that it has been fixed in version 12 of the theme which is not currently true.

Here’s an example on your own demo site:

The request:

curl -i -s -k -X $'POST' -H $'Host: demo.tagdiv.com' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/119.0' -H $'Content-Length: 119' -H $'Content-Type: application/x-www-form-urlencoded' --data-binary $'action=td_ajax_loop&loopState[moduleId]=--><form><math><img+src=1><mtext></form><!--&loopState[server_reply_html_data]=' $'https://demo.tagdiv.com/newspaper_pro/wp-admin/admin-ajax.php?td_theme_name=Newspaper'

The (truncated) response:

HTTP/2 200
...
content-type: text/html; charset=UTF-8
...

...

Notice how the parameters sent via ajax are returned to the client unescaped, in particular the form with an img tag inside. And because HTML tags are not being properly escaped, combined with the fact that the Content-Type of the response is text/html, this results in the malformed request being reflected towards the client and rendered as HTML, which can be abused by a malicious actor.

Your error message handling attempts to safeguard this by adding comment indicators around the content, but that can be trivially manipulated as per the example above.

A possible solution:

In your td-composer plugin, the function error of the class td_util is responsible for dealing with this content. The following line:

echo '<strong class="td-wp-booster-title">wp_booster error:</strong><br>' . $message;

Can be changed to the following alternative, sidestepping the issue cleanly:

echo '<strong class="td-wp-booster-title">wp_booster error:</strong><br>' . esc_html($message);

Hope to see this resolved in a future update.
Best regards.