Lucene search
Lana CodesWPVDB-ID:C6CF792B-054C-4D77-BCAE-3B700F42130BHistoryJan 19, 2023 - 12:00 a.m.
YARPP - Yet Another Related Posts Plugin < 5.30.3 - Contributor+ Stored XSS
2023-01-1900:00:00
Lana Codes
wpscan.com
10
yarpp plugin
stored xss
contributor role
cross-site scripting
security vulnerability
0.001 Low
EPSS
Percentile
21.6%
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PoC
v < 5.30.3 [yarpp template=“’ onmouseover='alert(/XSS/)”] v < 5.30.2 [yarpp extra_css_class=“’ onmouseover='alert(/XSS/)”]
| CPE | Name | Operator | Version |
|---|---|---|---|
| yet-another-related-posts-plugin | lt | 5.30.3 |
Related
cvelist
cvelist
cve
cve
CVE-2022-4471
2023-02-13 15:15:16
prion
prion
Cross site scripting
2023-02-13 15:15:00
nvd
nvd
CVE-2022-4471
2023-02-13 15:15:16
wpexploit
wpexploit
YARPP - Yet Another Related Posts Plugin < 5.30.3 - Contributor+ Stored XSS
2023-01-19 00:00:00
openvas
openvas
WordPress YARPP Plugin < 5.30.3 Multiple Vulnerabilities
2023-04-14 00:00:00