WordPress Lazy load videos and sticky control plugin <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Lazy load videos and sticky control versions = 3.0.0...

CVE-2024-11428

The CVE CVE-2024-11428 describes a Stored Cross-Site Scripting (XSS) in the WordPress plugin “Lazy load videos and sticky control” (shortcode: lazy-load-videos-and-sticky-control) affecting all versions up to and including 3.0.0. The root cause is insufficient input sanitization and output escapi...

CVE-2024-11428: Improper Neutralization of Input During Web Page Generation

The Lazy load videos and sticky control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lazy-load-videos-and-sticky-control' shortcode in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping on user supplied...

WordPress plugin Lazy load videos and sticky control 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in th...