PDF Block <= 1.1.0 - Contributor+ Stored XSS

2023-10-2600:00:00

wpscan.com

pdf block plugin validate escape stored cross-site scripting attacks

AI Score

5.7

Confidence

High

EPSS

Percentile

14.0%

JSON

Description The plugin does not validate and escape some parameters, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

References

patchstack.com/database/vulnerability/pdf-block/wordpress-pdf-block-plugin-1-1-0-cross-site-scripting-xss-vulnerability

www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/pdf-block/pdf-block-110-authenticated-contributor-stored-cross-site-scripting