WordPress Lazy load videos and sticky control plugin <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Lazy load videos and sticky control versions = 3.0.0...

CVE-2024-11428

The CVE CVE-2024-11428 describes a Stored Cross-Site Scripting (XSS) in the WordPress plugin “Lazy load videos and sticky control” (shortcode: lazy-load-videos-and-sticky-control) affecting all versions up to and including 3.0.0. The root cause is insufficient input sanitization and output escapi...

CVE-2024-11428: Improper Neutralization of Input During Web Page Generation

The Lazy load videos and sticky control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lazy-load-videos-and-sticky-control' shortcode in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping on user supplied...

WordPress plugin: Lazy load videos and sticky controls – cross-site scripting vulnerabilities

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in th...

PT-2024-16983

Name of the Vulnerable Software and Affected Versions Lazy load videos and sticky control plugin for WordPress versions up to, and including, 3.0.0 Description The issue is related to Stored Cross-Site Scripting in the plugin's 'lazy-load-videos-and-sticky-control' shortcode due to insufficient...