Lucene search
Apple502jWPEX-ID:A092548F-1AD5-44D3-9901-CDF4EBCEE40AHistoryAug 30, 2021 - 12:00 a.m.
CoolClock < 4.3.5 - Contributor+ Stored Cross-Site Scripting
2021-08-3000:00:00
apple502j
271
0.001 Low
EPSS
Percentile
24.9%
The plugin does not escape some shortcode attributes, allowing users with a role as low as Contributor toperform Stored Cross-Site Scripting attacks
As a user with a role as low as contributor, put the following shortcode in a post/page and view/preview it to trigger the XSS (which is specific to the TwentyTwentuOne theme but could be changed)
[coolclock fontcolor='orange" style="animation-name:twentytwentyone-close-button-transition" onanimationend="alert(origin)//']Related
prion
prion
Cross site scripting
2021-09-27 16:15:00
wpvulndb
wpvulndb
CoolClock < 4.3.5 - Contributor+ Stored Cross-Site Scripting
2021-08-30 00:00:00
patchstack
patchstack
cvelist
cvelist
CVE-2021-24670 CoolClock < 4.3.5 - Contributor+ Stored Cross-Site Scripting
2021-09-27 15:25:38
nvd
nvd
CVE-2021-24670
2021-09-27 16:15:09
cve
cve
CVE-2021-24670
2021-09-27 16:15:09