CVE-2022-4666 Markup <= 4.8.1 - Contributor+ Stored XSS via Shortcode

The Markup JSON-LD structured in schema.org WordPress plugin through 4.8.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Sit...

CVE-2023-0366 Loan Comparison < 1.5.3 - Contributor+ Stored XSS via shortcode

The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0540

The GS Filterable Portfolio WordPress plugin before 1.6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attac...

CVE-2023-0541

The GS Books Showcase WordPress plugin before 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4752 Opening Hours <= 2.3.0 - Contributor+ Stored XSS via Shortcode

The Opening Hours WordPress plugin through 2.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4784 Hueman Addons <= 2.3.3 - Contributor+ Stored XSS via Shortcode

The Hueman Addons WordPress plugin through 2.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0492

The GS Products Slider for WooCommerce WordPress plugin before 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

CVE-2023-0559

The GS Portfolio for Envato WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2023-0067 Timed Content < 2.73 - Contributor+ Stored XSS

The Timed Content WordPress plugin before 2.73 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0067

The Timed Content WordPress plugin before 2.73 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2023-16346

Name of the Vulnerable Software and Affected Versions GS Filterable Portfolio WordPress plugin versions prior to 1.6.1 Description The issue concerns the GS Filterable Portfolio WordPress plugin, which does not properly validate and escape certain shortcode attributes before outputting them in a...

WordPress Plugin Video.js Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress plugin GS Products Slider for WooCommerce has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-14983

Name of the Vulnerable Software and Affected Versions The Markup JSON-LD structured in schema.org WordPress plugin versions 4.8.1 and earlier Description The issue concerns a failure to validate and escape certain shortcode attributes in the plugin, which could allow users with the contributor ro...

PT-2023-15976

Name of the Vulnerable Software and Affected Versions Youzify WordPress plugin versions prior to 1.2.2 Description The issue is related to the Youzify WordPress plugin not validating and escaping some of its shortcode attributes before outputting them back in a page or post where the shortcode is...

WordPress Plugin: Loan Comparison – Cross-site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-15984 · WordPress · Timed Content

Name of the Vulnerable Software and Affected Versions: Timed Content WordPress plugin versions prior to 2.73 Description: The issue concerns the Timed Content WordPress plugin, which does not properly validate and escape some of its shortcode attributes before outputting them in a page or post...

PT-2023-16216 · WordPress · Loan Comparison Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Loan Comparison WordPress plugin versions prior to 1.5.3 Description: The issue arises from the plugin's failure to validate and escape some of its shortcode attributes before outputting them back in a page or post where the shortcode is...

PT-2023-15492

Name of the Vulnerable Software and Affected Versions The Video Sidebar Widgets WordPress plugin versions through 6.1 Description The issue concerns a lack of validation and escaping of certain shortcode attributes in the plugin, which could allow users with the contributor role and above to...

PT-2023-16222 · WordPress · Embedstories

Name of the Vulnerable Software and Affected Versions: EmbedStories WordPress plugin versions prior to 0.7.5 Description: The issue concerns a lack of validation and escaping of certain shortcode attributes in the EmbedStories WordPress plugin, which could allow users with the contributor role an...