Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.17.3 - Reflected Cross-Site Scripting

deactivate';
```
Wait, there's no reflection of $_GET here.

*   Let's try the Dashboard page.
*   Page: `admin.php?page=pms-dashboard-page`
*   Try parameters: `pms_add_ons_action`, `interval`, `search`.

*   *Wait!* I found it! Look at `assets/libs/pms-add-ons-listing/pms-add-ons-listing.php` line 185.
    ```php
    $base_url = admin_url( 'admin.php?page='. sanitize_text_field( $_REQUEST['page'] ) );
    ```
    If the admin is on `admin.php?page=pms-add-ons`.
    If the plugin uses this `$base_url` to generate links.
    What if we add another parameter to the `page`?
    `admin.php?page=pms-add-ons&test="><script>alert(1)</script>`
    Does `test` get reflected?

*   Actually, let's look at the description again: "arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
*   This sounds like the XSS payload is *in the link*.
*   Example: `https://site.com/wp-admin/admin