CVE-2022-4483 Insert Pages < 3.7.5 - Contributor+ Stored XSS

The Insert Pages WordPress plugin before 3.7.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege...

CVE-2022-4483

The CVE-2022-4483 entry concerns the Insert Pages WordPress plugin prior to version 3.7.5. The root cause is that the plugin does not validate and escape certain shortcode attributes before output, enabling Stored XSS by users with as low as contributor privileges against high‑privilege admins. A...