CVE-2024-3978

The CVE CVE-2024-3978 concerns the WordPress Jitsi Shortcode plugin (<= version 0.1). It does not validate or escape certain shortcode attributes, allowing stored XSS when the shortcode is embedded in a page/post by users with Contributor+ privileges. The vulnerability impact is described as S...

CVE-2024-3977

CVE-2024-3977 affects the WordPress Jitsi Shortcode plugin (versions ≤ 0.1). The issue arises because settings are not sanitised/escaped, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disabled. Public exploit details or in-the-wild exploitation informatio...