CVE-2023-0371 EmbedSocial < 1.1.28 - Contributor+ Stored XSS

The EmbedSocial WordPress plugin before 1.1.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0371

CVE-2023-0371 affects the EmbedSocial WordPress plugin prior to version 1.1.28. The vulnerability stems from inadequate validation and escaping of shortcode attributes before output, enabling Stored XSS for users with the contributor role and above. Impact is stored cross-site scripting on pages/...

CVE-2023-0371 EmbedSocial < 1.1.28 - Contributor+ Stored XSS

The EmbedSocial WordPress plugin before 1.1.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress EmbedSocial Plugin < 1.1.28 is vulnerable to Cross Site Scripting (XSS)

Software EmbedSocial Type Plugin Vulnerable versions 1.1.28 Fixed in 1.1.28 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0371 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 80b948605bdb Credits István Márton Required...