Cross site scripting

The PixCodes WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege use...

Cross site scripting

The Justified Gallery WordPress plugin before 1.7.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack...

CVE-2022-4765 Portfolio for Elementor, Image Gallery & Post Grid | PowerFolio < 2.3.1 - Contributor+ Stored XSS via Shortcode

The Portfolio for Elementor WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against hig...

CVE-2022-4837 CPO Companion < 1.1.0 - Contributor+ Stored XSS via Shortcode

The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privileg...

CVE-2022-4835 Social Sharing Toolkit <= 2.6 - Contributor+ Stored XSS via Shortcode

The Social Sharing Toolkit WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

CVE-2022-4834 CPT Bootstrap Carousel <= 1.12 - Contributor+ Stored XSS via Shortcode

The CPT Bootstrap Carousel WordPress plugin through 1.12 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

CVE-2022-4776 CC Child Pages < 1.43 - Contributor+ Stored XSS via Shortcode

The CC Child Pages WordPress plugin before 1.43 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privileg...

PT-2023-15449 · WordPress · Portfolio For Elementor

Name of the Vulnerable Software and Affected Versions: The Portfolio for Elementor WordPress plugin versions prior to 2.3.1 Description: The issue concerns a lack of validation and escaping of certain shortcode attributes, which can lead to Stored Cross-Site Scripting attacks. Users with a role a...

PT-2023-15477

Name of the Vulnerable Software and Affected Versions CC Child Pages WordPress plugin versions prior to 1.43 Description The issue concerns the CC Child Pages WordPress plugin, which does not properly validate and escape some of its shortcode attributes before outputting them back in the page. Th...

CVE-2022-4699: Improper Neutralization of Input During Web Page Generation

The MediaElement.js WordPress plugin through 4.2.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against...

GS Books Showcase < 1.3.1 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC gsbookshowcase theme='"...

PT-2023-15502

Name of the Vulnerable Software and Affected Versions Themify Shortcodes WordPress plugin versions prior to 2.0.8 Description The issue is related to a lack of validation and escaping of one of its shortcode attributes. This could allow users with a role as low as contributor to perform a Stored...

PT-2023-14531

Name of the Vulnerable Software and Affected Versions Widgets for Google Reviews WordPress plugin versions prior to 9.8 Description The issue concerns a lack of validation and escaping of certain shortcode attributes, which can lead to Stored Cross-Site Scripting attacks. Users with a role as low...

PT-2023-14993

Name of the Vulnerable Software and Affected Versions PixCodes WordPress plugin versions prior to 2.3.7 Description The issue concerns the PixCodes WordPress plugin, which does not properly validate and escape certain shortcode attributes before outputting them. This could allow users with a role...

PT-2023-14946

Name of the Vulnerable Software and Affected Versions WP Extended Search WordPress plugin versions prior to 2.1.2 Description The issue allows users with a role as low as contributor to perform a Stored Cross-Site Scripting attack due to the lack of validation and escaping of one of its shortcode...

PT-2023-15660

Name of the Vulnerable Software and Affected Versions Bold Timeline Lite WordPress plugin versions prior to 1.1.5 Description The issue concerns a lack of validation and escaping of some shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site...

PT-2023-14537

Name of the Vulnerable Software and Affected Versions The Simple Sitemap WordPress plugin versions prior to 3.5.8 Description The issue arises from the plugin's failure to validate and escape some of its shortcode attributes before outputting them back in the page. This could allow users with a...

PT-2023-15726

Name of the Vulnerable Software and Affected Versions Social Sharing Toolkit WordPress plugin versions through 2.6 Description The issue concerns a lack of validation and escaping of some shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site...

PT-2023-15988

Name of the Vulnerable Software and Affected Versions WP Tabs WordPress plugin versions prior to 2.1.17 Description The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the plugin's failure to validate and escape some of its shortcode...

PT-2023-15528

Name of the Vulnerable Software and Affected Versions The News & Blog Designer Pack WordPress plugin versions prior to 3.3 Description The issue concerns a lack of validation and escaping of one of the shortcode attributes in the plugin. This could allow users with a role as low as contributor to...