Shariff Wrapper < 4.6.10 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Put the following payload in the...

Cross-Site Scripting in extension "Heise Shariff" (rx_shariff)

The extension fails to properly encode user input for output in HTML context...

Shariff for WordPress <= 1.0.7 - Stored Cross-Site Scripting (XSS)

On the "Settings Shariff" screen, the input field 'shariffimage' is saved without any validation. Malicious JavaScript can be injected. Screenshots: http://imgur.com/hipNRLW http://imgur.com/N6djVaE...

WordPress Shariff Plugin <= 1.0.7 - Stored Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...