CVE-2021-24408

The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters, allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS trigger able in th...

CVE-2021-24408

CVE-2021-24408 involves the Prismatic WordPress plugin, vulnerable in versions before 2.8. It does not sanitize/validate certain shortcode parameters, enabling stored XSS from users with roles as low as Contributor. A contributor-created post requires admin approval for the XSS to trigger in the ...

CVE-2021-24408 Prismatic < 2.8 - Contributor+ Stored XSS

The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters, allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS trigger able in th...