5 matches found
CVE-2021-24825
CVE-2021-24825 affects the WordPress plugin Custom Content Shortcode (versions before 4.0.2). The issue arises because load shortcode data is not validated, allowing authenticated contributors (v<4.0.1) or admins (v
CVE-2021-24824
The CVE-2021-24824 entry concerns the WordPress Custom Content Shortcode plugin before 4.0.1. The vulnerability allows authenticated users with a low-privilege role (as low as contributor) to access arbitrary post metadata, enabling potential sensitive data disclosure (e.g., WooCommerce order ema...
CVE-2021-24826
The CVE-2021-24826 issue affects the WordPress plugin “Custom Content Shortcode” prior to version 4.0.2. The vulnerability arises because the plugin does not escape custom fields before output, enabling authenticated users with Contributor+ (v < 4.0.1) or Admin+ (v