Lucene search
Lana CodesWPEX-ID:0D679E0E-891B-44F1-AC7F-A766E12956E0HistoryDec 24, 2022 - 12:00 a.m.
Easy Bootstrap Shortcode <= 4.5.4 - Contributor+ Stored XSS
2022-12-2400:00:00
Lana Codes
70
bootstrap shortcode contributor stored xss alert trigger.
0.001 Low
EPSS
Percentile
23.3%
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
1. Insert this shortcode in a page/post: [row class='" onmouseover="alert(1)" style="background:red;width:100px;height:100px;"']
2. Hover over the inserted block, and the alert will trigger successfully.Related
prion
prion
Cross site scripting
2023-01-23 15:15:00
cvelist
cvelist
CVE-2022-4576 Easy Bootstrap Shortcode <= 4.5.4 - Contributor+ Stored XSS
2023-01-23 14:31:32
cve
cve
CVE-2022-4576
2023-01-23 15:15:15
nvd
nvd
CVE-2022-4576
2023-01-23 15:15:15
wpvulndb
wpvulndb
Easy Bootstrap Shortcode <= 4.5.4 - Contributor+ Stored XSS
2022-12-24 00:00:00