Lucene search
Lana CodesWPVDB-ID:79F011E4-3422-4307-8736-F27048796AAEHistoryJan 24, 2023 - 12:00 a.m.
Page Builder: Live Composer < 1.5.23 - Contributor+ Stored XSS via Shortcode
2023-01-2400:00:00
Lana Codes
wpscan.com
7
page builder
live composer
stored xss
shortcode
cross-site scripting
contributor
poc
plugin
security vulnerability
0.001 Low
EPSS
Percentile
21.2%
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PoC
[dslc_notification color=‘red" onmouseover=“alert(1)”’]
| CPE | Name | Operator | Version |
|---|---|---|---|
| live-composer-page-builder | lt | 1.5.23 |
Related
prion
prion
Cross site scripting
2023-02-21 09:15:00
cvelist
cvelist
cve
cve
CVE-2022-4669
2023-02-21 09:15:10
nvd
nvd
CVE-2022-4669
2023-02-21 09:15:10
wpexploit
wpexploit
Page Builder: Live Composer < 1.5.23 - Contributor+ Stored XSS via Shortcode
2023-01-24 00:00:00
fedora
fedora
[SECURITY] Fedora 36 Update: webkit2gtk3-2.38.3-1.fc36
2022-12-31 01:17:03
[SECURITY] Fedora 37 Update: webkitgtk-2.38.3-2.fc37
2022-12-27 01:13:43