Lucene search
Lana CodesWPVDB-ID:32324655-FF91-4A53-A2C5-EBE6678D4A9DHistoryJan 12, 2023 - 12:00 a.m.
jQuery T(-) Countdown Widget < 2.3.24 - Contributor+ Stored XSS
2023-01-1200:00:00
Lana Codes
wpscan.com
7
jquery countdown
stored xss
contributor role
shortcode attributes
cross-site scripting
0.001 Low
EPSS
Percentile
23.5%
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PoC
[tminus t=‘2100-01-01’ width=‘" onmouseover=“alert(1)”’]
| CPE | Name | Operator | Version |
|---|---|---|---|
| jquery-t-countdown-widget | lt | 2.3.24 |
Related
nvd
nvd
CVE-2023-0171
2023-02-06 20:15:13
cvelist
cvelist
cve
cve
CVE-2023-0171
2023-02-06 20:15:13
prion
prion
Cross site scripting
2023-02-06 20:15:00
wpexploit
wpexploit
jQuery T(-) Countdown Widget < 2.3.24 - Contributor+ Stored XSS
2023-01-12 00:00:00