Lucene search
Lana CodesWPEX-ID:3B5C377C-3148-4373-996C-89851D5E39E5HistoryDec 28, 2022 - 12:00 a.m.
Collapse-O-Matic < 1.8.3 - Contributor+ Stored XSS
2022-12-2800:00:00
Lana Codes
223
stored xss
shortcode
contributor+
EPSS
0.001
Percentile
25.5%
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Exploit shortcode:
[expand elwraptag='div' elwrapclass='" onmouseover="alert(1)"']Related
prion
prion
Cross site scripting
2023-01-23 15:15:00
cvelist
cvelist
CVE-2022-4475 Collapse-O-Matic < 1.8.3 - Contributor+ Stored XSS
2023-01-23 14:31:34
cve
cve
CVE-2022-4475
2023-01-23 15:15:14
wpvulndb
wpvulndb
Collapse-O-Matic < 1.8.3 - Contributor+ Stored XSS
2022-12-28 00:00:00
nvd
nvd
CVE-2022-4475
2023-01-23 15:15:14