Lucene search
Lana CodesWPVDB-ID:CC308E15-7937-4D41-809D-74F8C13BEE23HistoryJan 12, 2023 - 12:00 a.m.
Annual Archive < 1.6.0 - Contributor+ Stored XSS
2023-01-1200:00:00
Lana Codes
wpscan.com
9
archive
plugin
stored xss
EPSS
0.001
Percentile
25.5%
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PoC
[archives tag=‘ul onmouseover=“alert(1)”’]
Related
openvas
openvas
WordPress Annual Archive Plugin < 1.6.0 XSS Vulnerability
2023-09-20 00:00:00
cvelist
cvelist
CVE-2023-0178 Annual Archive < 1.6.0 - Contributor+ Stored XSS
2023-02-06 19:59:08
wpexploit
wpexploit
Annual Archive < 1.6.0 - Contributor+ Stored XSS
2023-01-12 00:00:00
prion
prion
Cross site scripting
2023-02-06 20:15:00
cve
cve
CVE-2023-0178
2023-02-06 20:15:13
nvd
nvd
CVE-2023-0178
2023-02-06 20:15:13