Lucene search
Lana CodesWPVDB-ID:BB2B876F-7216-4F31-9D1F-A45405C545CEHistoryJan 11, 2023 - 12:00 a.m.
WC Vendors Marketplace < 2.4.5 - Contributor+ Stored XSS
2023-01-1100:00:00
Lana Codes
wpscan.com
16
wc vendors marketplace
contributor role
stored xss
cross-site scripting
EPSS
0.001
Percentile
25.5%
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PoC
[wcv_recent_products columns=‘1" onmouseover=“alert(1)”’]
Related
cve
cve
CVE-2023-0072
2023-02-06 20:15:12
wpexploit
wpexploit
WC Vendors Marketplace < 2.4.5 - Contributor+ Stored XSS
2023-01-11 00:00:00
prion
prion
Cross site scripting
2023-02-06 20:15:00
cvelist
cvelist
CVE-2023-0072 WC Vendors Marketplace < 2.4.5 - Contributor+ Stored XSS
2023-02-06 19:59:47
nvd
nvd
CVE-2023-0072
2023-02-06 20:15:12