Summary

Stored XSS via malicious Plan extensions.

Details

The vulnerability is in react-mcjsonchat@1.0.0 dependency, used by Plan's React dashboard.
Vulnerable code: node_modules/react-mcjsonchat/dist/esm/index.js:90-92

case "open_url":
      return React.createElement("a", { href: clickEvent.value, ...}, props.children);

clickEvent.value is passed directly to href without URL validation, allowing javascript: execution.

Flow:

1. Extension returns @ComponentProvider with clickEvent.action: "open_url" and clickEvent.value: "javascript:..."
2. Plan stores JSON in database → API returns as type: "COMPONENT"
3. ExtensionCard.jsx:61 passes to <MinecraftChat component={JSON.parse(data.value)}/>
4. react-mcjsonchat renders <a href="javascript:...">

Plan could sanitize the parsed JSON before passing it or validate clickEvent.value URLs.

PoC

1. Install attached xss-test-plugin-1.0.0.jar(https://gofile.io/d/laeK35)
2. Open Plan dashboard
3. Navigate to Plugins Overview
4. Click "Click here" link
5. Alert shows document.cookie

Impact

Stored xss impacts dashboard users