Lucene search
Lana CodesWPEX-ID:9DC9D377-635D-4D4F-9916-33BCEDBBA6F0HistoryDec 20, 2022 - 12:00 a.m.
Mesmerize Companion < 1.6.135 - Contributor+ Stored XSS
2022-12-2000:00:00
Lana Codes
90
vulnerability
stored xss
contributor+
wordpress theme
mesmerize companion
EPSS
0.001
Percentile
25.4%
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Required theme: https://wordpress.org/themes/mesmerize (the shortcode is added only if this theme is used)
Exploit shortcode:
[mesmerize_latest_news item_class='" onmouseover="alert(1)']Related
prion
prion
Cross site scripting
2023-01-16 16:15:00
cvelist
cvelist
CVE-2022-4481 Mesmerize Companion < 1.6.135 - Contributor+ Stored XSS
2023-01-16 15:37:56
wpvulndb
wpvulndb
Mesmerize Companion < 1.6.135 - Contributor+ Stored XSS
2022-12-20 00:00:00
nvd
nvd
CVE-2022-4481
2023-01-16 16:15:12
cve
cve
CVE-2022-4481
2023-01-16 16:15:12