CVE-2023-4799

The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

EUVD-2025-8611

Malicious code in bioql PyPI...

CVE-2025-31433

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Miguel Sirvent Magic Embeds wp-embed-facebook allows Stored XSS.This issue affects Magic Embeds: from n/a through = 3.1.2...

WordPress Magic Embeds plugin <= 3.1.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Magic Embeds versions = 3.1.2...

CVE-2025-31433

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Miguel Sirvent Magic Embeds wp-embed-facebook allows Stored XSS.This issue affects Magic Embeds: from n/a through = 3.1.2...

CVE-2025-31433 WordPress Magic Embeds plugin <= 3.1.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Miguel Sirvent Magic Embeds wp-embed-facebook allows Stored XSS.This issue affects Magic Embeds: from n/a through = 3.1.2...

CVE-2025-31433

CVE-2025-31433 is a Stored XSS in the WordPress plugin Magic Embeds (affected: Magic Embeds

CVE-2025-31433 WordPress Magic Embeds plugin <= 3.1.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Miguel Sirvent Magic Embeds wp-embed-facebook allows Stored XSS.This issue affects Magic Embeds: from n/a through = 3.1.2...

WordPress plugin Magic Embeds 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2023-4799

The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Cross site scripting

The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-4799 Magic Embeds < 3.1.2 - Contributor+ Stored XSS via shortcode

The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-4799

CVE-2023-4799 – Magic Embeds WordPress plugin : The vulnerability affects versions before 3.1.2 (plugin prior to 3.1.2) where shortcode attributes are not properly validated/escaped before output in pages/posts. This can enable a contributor+ user to perform Stored Cross-Site Scripting via the pl...

PT-2023-30662 · WordPress · Magic Embeds

Name of the Vulnerable Software and Affected Versions: The Magic Embeds WordPress plugin versions prior to 3.1.2 Description: The issue concerns a lack of validation and escaping of certain shortcode attributes in the plugin, which could allow users with the contributor role and above to perform...

WordPress Plugin Magic Embeds Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...

WordPress Magic Embeds Plugin <= 3.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Magic Embeds Type Plugin Vulnerable versions = 3.1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4799 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 630b7a6e83b9 Credits Dmitrii Ignatyev Required...

Magic Embeds < 3.1.2 - Contributor+ Stored XSS via shortcode

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks v 3.1.1 - fbplugin video...