Simple Blog Card < 1.31 - Contributor+ Stored XSS via Shortcode

2023-08-0200:00:00

Dmitrii Ignatyev

contributor

shortcode

stored xss

attributes

exploit

0.0004 Low

EPSS

Percentile

14.2%

JSON

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

As a contributor, put the following shortcode in a post

[simpleblogcard url="http://***.*/" color='red;" onmouseover="alert(/XSS/)"']

Other affected attributes: color, color_width, t_line_height, d_line_height