Currency Converter Calculator < 1.3.2 - Contributor+ Stored XSS

2023-12-0800:00:00

wpscan.com

plugin

stored xss

input sanitization

output escaping

user attributes

contributor+ permissions

authenticated attackers

web scripts

AI Score

5.3

Confidence

High

EPSS

Percentile

14.0%

JSON

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin’s shortcode(s) due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References

patchstack.com/database/vulnerability/currency-converter-calculator/wordpress-currency-converter-calculator-plugin-1-3-1-cross-site-scripting-xss-vulnerability