JVN#26026353: WordPress plugin "Markdown on Save Improved" vulnerable to cross-site scripting

The WordPress plugin “Markdown on Save Improved” contains a stored cross-site scripting (CWE-79) vulnerability.

Impact

An arbitrary script may be executed on the user’s web browser.

Solution

Update the plugin
Update the plugin according to the information provided by the developer.

While the developer provided an update for this vulnerability, the developer states that this plugin is deprecated. Fixes may not be provided in the future, so it is recommended to transition to a different module.

Products Affected

• Markdown on Save Improved version 2.5 and earlier