BP Profile Shortcodes Extra < 2.5.3 - Contributor+ Stored XSS

2023-11-2300:00:00

wpscan.com

plugin

validation

shortcode

contributor role

xss

security

0.0004 Low

EPSS

Percentile

14.2%

JSON

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

CPENameOperatorVersion
eq2.5.3

CPE	Name	Operator	Version
		eq	2.5.3

References

patchstack.com/database/vulnerability/bp-profile-shortcodes-extra/wordpress-bp-profile-shortcodes-extra-plugin-2-5-2-cross-site-scripting-xss-vulnerability

0.0004 Low

EPSS

Percentile

14.2%

JSON

Related for WPVDB-ID:45F8850D-6C1F-45DE-919D-27F7605D3E62