Lucene search

WpvulndbWPVDB-ID:140219B6-CC6F-45E4-9F36-96477B9335B8

HistoryDec 02, 2023 - 12:00 a.m.

Evergreen Content Poster < 1.4.1 - Admin+ Stored XSS

2023-12-0200:00:00

wpscan.com

plugin

sanitization

settings

stored xss

high privilege users

admin

unfiltered_html

capability

multisite setup

5.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.0%

JSON

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CPENameOperatorVersion
eq1.4.1

CPE	Name	Operator	Version
		eq	1.4.1

References

patchstack.com/database/vulnerability/evergreen-content-poster/wordpress-evergreen-content-poster-plugin-1-3-6-1-cross-site-scripting-xss-vulnerability