CVE-2022-4789 WPZOOM Portfolio < 1.2.2 - Contributor+ Stored XSS via Shortcode

The WPZOOM Portfolio WordPress plugin before 1.2.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack...

CVE-2022-4789

The CVE concerns WPZOOM Portfolio WordPress plugin prior to version 1.2.2. The vulnerability is a Stored XSS resulting from improper validation/escaping of a shortcode attribute, which could be exploited by users with a role as low as contributor. Practical impact is exposure of stored script con...

PT-2023-15518 · Wpzoom · Wpzoom Portfolio Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: WPZOOM Portfolio WordPress plugin versions prior to 1.2.2 Description: The issue concerns a lack of validation and escaping of one of the shortcode attributes in the WPZOOM Portfolio WordPress plugin. This could allow users with a role as low...

WordPress plugin WPZOOM Portfolio 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

WordPress WPZOOM Portfolio Plugin < 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Software WPZOOM Portfolio Type Plugin Vulnerable versions 1.2.2 Fixed in 1.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4789 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID 6f91f80a704a Credits István Márton...

CVE-2021-24632

The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-24632

The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-24634

The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings, which could allow users with a role as low as contributor to perfor...

CVE-2021-24634

WPZOOM’s Recipe Card Blocks (Gutenberg/Elementor) for WordPress before 2.8.3 is vulnerable to Stored XSS due to insufficient sanitization/escaping of several properties (e.g., ingredientsLayout, iconSet, steps, ingredients, recipeTitle, settings). Exploitation requires at least a contributor+ rol...

CVE-2021-24634 Recipe Card Blocks < 2.8.3 - Contributor+ Stored Cross-Site Scripting

The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings, which could allow users with a role as low as contributor to perfor...

CVE-2021-24632

CVE-2021-24632 – Recipe Card Blocks by WPZOOM (WordPress) : Affected component is the Recipe Card Blocks plugin for WordPress (by WPZOOM). Versions prior to 2.8.1 are vulnerable to a Reflected Cross-Site Scripting (XSS) flaw in which the plugin fails to escape the message parameter before echoing...

CVE-2021-24632 Recipe Card Blocks < 2.8.1 - Reflected Cross-Site Scripting

The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue...