WordPress plugin WP Travel Engine跨站脚本漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of WordPress WP Travel Engine plugin prior to 5.3.1, whic...

WP Travel Engine < 5.3.1 - Editor+ Stored Cross-Site Scripting

The plugin does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfilteredhtml capability is disallowed PoC As an editor or admin, ad...

WordPress WP Travel Engine plugin <= 5.3.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Huy Nguyen in WordPress WP Travel Engine plugin versions = 5.3.0. Solution Update the WordPress WP Travel Engine plugin to the latest available version at least 5.3.1...

WP Travel Engine < 5.3.1 - Editor+ Stored Cross-Site Scripting

The plugin does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfilteredhtml capability is disallowed As an editor or admin, add or...