Lucene search
Lana CodesWPVDB-ID:2D9AE43B-75A7-4FCC-BCE3-D9E9D7A97EC0HistoryJan 03, 2023 - 12:00 a.m.
PDF Viewer < 1.0.0 - Contributor+ Stored XSS via Shortcode
2023-01-0300:00:00
Lana Codes
wpscan.com
21
pdf viewer stored xss
shortcode
contributor role
cross-site scripting
software vulnerability
EPSS
0.001
Percentile
25.5%
The plugin does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
PoC
Exploit shortcode: [pdfviewer height=‘" onmouseover=“alert(1)”’]http://localhost/file.pdf[/pdfviewer]
Related
cve
cve
CVE-2023-0033
2023-01-30 21:15:13
nvd
nvd
CVE-2023-0033
2023-01-30 21:15:13
wpexploit
wpexploit
PDF Viewer < 1.0.0 - Contributor+ Stored XSS via Shortcode
2023-01-03 00:00:00
prion
prion
Cross site scripting
2023-01-30 21:15:00
cvelist
cvelist
CVE-2023-0033 PDF Viewer < 1.0.0 - Contributor+ Stored XSS via Shortcode
2023-01-30 20:31:53