CVE-2023-0333 TemplatesNext ToolKit < 3.2.9 - Contributor+ Stored XSS

The TemplatesNext ToolKit WordPress plugin before 3.2.9 does not validate some of its shortcode attributes before using them to generate an HTML tag, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0333

The CVE-2023-0333 entry concerns the TemplatesNext ToolKit WordPress plugin prior to version 3.2.9. The issue is that the plugin does not validate some shortcode attributes before using them to generate HTML tags, enabling Stored Cross-Site Scripting (XSS) when an attacker with Contributor privil...

CVE-2023-0333 TemplatesNext ToolKit < 3.2.9 - Contributor+ Stored XSS

The TemplatesNext ToolKit WordPress plugin before 3.2.9 does not validate some of its shortcode attributes before using them to generate an HTML tag, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4678 TemplatesNext ToolKit < 3.2.8 - Contributor+ Stored XSS via Shortcode

The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4678

CVE-2022-4678 affects the TemplatesNext ToolKit WordPress plugin prior to 3.2.8. The vulnerability arises because certain shortcode attributes are not validated or escaped before being output, enabling Stored XSS for users with the contributor role or higher in pages/posts where the shortcode is ...

CVE-2022-4678 TemplatesNext ToolKit < 3.2.8 - Contributor+ Stored XSS via Shortcode

The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress plugin TemplatesNext ToolKit 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

WordPress plugin TemplatesNext ToolKit 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

TemplatesNext ToolKit < 3.2.9 - Contributor+ Stored XSS

The plugin does not validate some of its shortcode attributes before using them to generate an HTML tag, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks txheading tag='script' headingtext='alert/XSS/'...

TemplatesNext ToolKit < 3.2.9 - Contributor+ Stored XSS

The plugin does not validate some of its shortcode attributes before using them to generate an HTML tag, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC txheading tag='script' headingtext='alert/XSS/'...

WordPress TemplatesNext ToolKit Plugin < 3.2.9 is vulnerable to Cross Site Scripting (XSS)

Software TemplatesNext ToolKit Type Plugin Vulnerable versions 3.2.9 Fixed in 3.2.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0333 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 9f3110209bb9 Credits WPScan Require...

TemplatesNext ToolKit < 3.2.8 - Contributor+ Stored XSS

The plugin does not sanitise and escape some Widget parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...

TemplatesNext ToolKit < 3.2.8 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC txheading margin='"...

WordPress TemplatesNext ToolKit Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)

Software TemplatesNext ToolKit Type Plugin Vulnerable versions = 3.2.7 Fixed in 3.2.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-22712 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9bfdd28ec3f2 Credits Rafshanzani Suhad...

TemplatesNext ToolKit < 3.2.8 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. txheading margin='" onmouseover="alert/XSS/...