Lucene search
Lana CodesWPVDB-ID:CA3CA694-54CA-4E7E-82E6-33AA240754E1HistoryJan 17, 2023 - 12:00 a.m.
YaMaps for WordPress Plugin < 0.6.26 - Contributor+ Stored XSS
2023-01-1700:00:00
Lana Codes
wpscan.com
13
yamaps
wordpress
plugin
vulnerability
contributor
stored xss
shortcode
attributes
validation
escape
page
post
cross-site scripting
attacks
0.001 Low
EPSS
Percentile
23.3%
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PoC
[yamap height=‘100px;" onmouseover=“alert(1)”’]
Related
prion
prion
Cross site scripting
2023-02-13 15:15:00
cvelist
cvelist
CVE-2023-0270 YaMaps for WordPress Plugin < 0.6.26 - Contributor+ Stored XSS
2023-02-13 14:32:02
nvd
nvd
CVE-2023-0270
2023-02-13 15:15:21
cve
cve
CVE-2023-0270
2023-02-13 15:15:21
wpexploit
wpexploit
YaMaps for WordPress Plugin < 0.6.26 - Contributor+ Stored XSS
2023-01-17 00:00:00