CVE-2024-0966

CVE-2024-0966 : The Shariff Wrapper WordPress plugin is vulnerable to Stored XSS via the plugin’s shariff shortcode in versions up to and including 4.6.9 due to insufficient input sanitization and output escaping on user-supplied attributes (e.g., info_text). This allows authenticated attackers w...

CVE-2024-1450

The CVE-2024-1450 entry concerns the Shariff Wrapper WordPress plugin. It is vulnerable to a Stored XSS via the plugin shortcode shariff in all versions up to and including 4.6.10 due to insufficient input sanitization and output escaping on user-supplied attributes (e.g., align). Exploitation re...

CVE-2024-1450 Shariff Wrapper <= 4.6.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including, 4.6.10 due to insufficient input sanitization and output escaping on user supplied attributes such as 'align'. This makes it possible fo...

PT-2024-18056 · WordPress · Shariff Wrapper

Name of the Vulnerable Software and Affected Versions: Shariff Wrapper plugin for WordPress versions up to, and including, 4.6.10 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode due to insufficient input sanitization and output escaping on...

WordPress Shariff Wrapper Plugin <= 4.6.9 is vulnerable to Cross Site Scripting (XSS)

Software Shariff Wrapper Type Plugin Vulnerable versions = 4.6.9 Fixed in 4.6.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0966 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 32b0d6ace355 Credits Muhammad Daffa Required...

Shariff Wrapper < 4.6.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including, 4.6.9 due to insufficient input sanitization and output escaping on user supplied attributes such as 'secondarycolor' and...

WordPress Shariff Wrapper Plugin <= 4.6.9 is vulnerable to Cross Site Scripting (XSS)

Software Shariff Wrapper Type Plugin Vulnerable versions = 4.6.9 Fixed in 4.6.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6500 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 66d31de1e026 Credits Rafshanzani Suhada...

Shariff Wrapper < 4.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including, 4.6.10 due to insufficient input sanitization and output escaping on user supplied attributes such as 'align'. This makes it...

WordPress Shariff Wrapper Plugin <= 4.6.10 is vulnerable to Cross Site Scripting (XSS)

Software Shariff Wrapper Type Plugin Vulnerable versions = 4.6.10 Fixed in 4.6.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1450 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 49c814a555ec Credits Richard Telleng stueot...

PT-2024-15946 · WordPress · Shariff Wrapper

Name of the Vulnerable Software and Affected Versions: Shariff Wrapper plugin for WordPress versions up to, and including, 4.6.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-14978 · WordPress · Shariff Wrapper

Name of the Vulnerable Software and Affected Versions: Shariff Wrapper plugin for WordPress versions up to, and including, 4.6.9 Description: The issue is related to Stored Cross-Site Scripting in the Shariff Wrapper plugin for WordPress. This is due to insufficient input sanitization and output...

CVE-2024-1106

The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Cross site scripting

The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-1106 Shariff Wrapper < 4.6.10 - Admin+ Stored XSS

The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-1106 Shariff Wrapper < 4.6.10 - Admin+ Stored XSS

The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-1106

CVE-2024-1106 – Shariff Wrapper (WordPress) : The plugin prior to 4.6.10 does not sanitize/escape certain settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). Reported impact includes potential XSS within outputs generated...

PT-2024-16732 · WordPress · Shariff Wrapper

Name of the Vulnerable Software and Affected Versions: Shariff Wrapper WordPress plugin versions prior to 4.6.10 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example,...

WordPress plugin Shariff Wrapper security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...

WordPress Shariff Wrapper Plugin < 4.6.10 is vulnerable to Cross Site Scripting (XSS)

Software Shariff Wrapper Type Plugin Vulnerable versions 4.6.10 Fixed in 4.6.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1106 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID da44df395b73 Credits Dmitrii Ignatyev Require...

Shariff Wrapper < 4.6.10 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Put the following payload in the...