CVE-2024-4217 Shortcodes Ultimate Pro < 7.1.5 - Contributor+ Stored Cross-Site Scripting XSS

2024-07-1306:00:05

WPScan

github.com

cve-2024-4217

wordpress

xss

stored cross-site scripting

AI Score

5.8

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

The shortcodes-ultimate-pro WordPress plugin before 7.1.5 does not properly escape some of its shortcodes’ settings, making it possible for attackers with a Contributor account to conduct Stored XSS attacks.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:getshortcodes:shortcodes_ultimate:*:*:*:*:*:wordpress:*:*"
    ],
    "vendor": "getshortcodes",
    "product": "shortcodes_ultimate",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "7.1.5",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]