CVE-2024-1219

2024-04-1705:15:48

[email protected]

web.nvd.nist.gov

easy social feed

wordpress plugin

stored cross-site scripting

7.9 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

The Easy Social Feed WordPress plugin before 6.5.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin

Affected configurations

Vulners

Node

easysocialfeedeasy_social_feedRange<6.5.6

VendorProductVersionCPE
easysocialfeedeasy_social_feed*cpe:2.3:a:easysocialfeed:easy_social_feed:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
easysocialfeed	easy_social_feed	*	cpe:2.3:a:easysocialfeed:easy_social_feed::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Easy Social Feed ",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "6.5.6"
      }
    ],
    "defaultStatus": "unaffected"
  }
]