CVE-2022-4678

The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4678 TemplatesNext ToolKit < 3.2.8 - Contributor+ Stored XSS via Shortcode

The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4678 TemplatesNext ToolKit < 3.2.8 - Contributor+ Stored XSS via Shortcode

The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4678

CVE-2022-4678 affects the TemplatesNext ToolKit WordPress plugin prior to 3.2.8. The vulnerability arises because certain shortcode attributes are not validated or escaped before being output, enabling Stored XSS for users with the contributor role or higher in pages/posts where the shortcode is ...