CVE-2024-1396

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titletag’ parameter in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-1396

CVE-2024-1396 affects the WordPress plugin Shortcodes and extra features for Phlox theme (auxin-elements). It is a stored XSS via the title_tag parameter in versions up to 2.15.5, exploitable by authenticated users with Contributor+ permissions. The issue can cause arbitrary scripts to run when u...