Lucene search
Dmitrii IgnatyevWPEX-ID:9EEF8B29-2C62-4DAA-AE90-467FF9BE18D8HistoryApr 24, 2024 - 12:00 a.m.
Shortcodes Ultimate < 7.1.2 - Contributor+ Stored XSS
2024-04-2400:00:00
Dmitrii Ignatyev
26
shortcode ultimate
contributor+
stored xss
vulnerability
may 08 2024
update
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Add the following shortcode to a post:
`[su_lightbox src='123"onmouseover="alert(1)"']Click here to open lightbox[/su_lightbox]`References
Related
cve
cve
CVE-2024-3548
2024-05-15 06:15:12
CVE-2024-4542
2024-05-14 15:44:02
vulnrichment
vulnrichment
CVE-2024-3548 Shortcodes Ultimate < 7.1.2 - Contributor+ Stored XSS
2024-05-15 06:00:03
nvd
nvd
CVE-2024-3548
2024-05-15 06:15:12
CVE-2024-4542
2024-05-14 15:44:02
wpvulndb
wpvulndb
Shortcodes Ultimate < 7.1.2 - Contributor+ Stored XSS
2024-04-24 00:00:00
cvelist
cvelist
CVE-2024-3548 Shortcodes Ultimate < 7.1.2 - Contributor+ Stored XSS
2024-05-15 06:00:03
wordfence
wordfence
6 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.1%
Related for WPEX-ID:9EEF8B29-2C62-4DAA-AE90-467FF9BE18D8