WordPress plugin Button contact VR 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...

WordPress Button contact VR Plugin < 4.7.7 is vulnerable to Cross Site Scripting (XSS)

Software Button contact VR Type Plugin Vulnerable versions 4.7.7 Fixed in 4.7.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2220 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2f62fd31490e Credits Dmitrii Ignatyev Require...

PT-2024-19269 · WordPress · Button Contact Vr Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Button contact VR WordPress plugin versions through 4.7 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised...

Button contact VR <= 4.7 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Click on the "Button contact" and chan...