Lucene search
Dmitrii IgnatyevWPEX-ID:914559E1-EED5-4A69-8371-A48055835453HistoryNov 03, 2023 - 12:00 a.m.
Medialist < 1.4.1 - Contributor+ Stored XSS
2023-11-0300:00:00
Dmitrii Ignatyev
39
medialist contributor xss
stored xss
exploit}
.
0.0004 Low
EPSS
Percentile
14.2%
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
[medialist style='" onmouseover="alert(/XSS/)"' rml_folder=/var/www/html/wordpress globalitems=1 ]References
Related
cve
cve
CVE-2023-5942
2023-11-27 17:15:09
cvelist
cvelist
CVE-2023-5942 Medialist < 1.4.1 - Contributor+ Stored XSS
2023-11-27 16:22:05
prion
prion
Cross site scripting
2023-11-27 17:15:00
nvd
nvd
CVE-2023-5942
2023-11-27 17:15:09
wpvulndb
wpvulndb
Medialist < 1.4.1 - Contributor+ Stored XSS
2023-11-03 00:00:00