Lucene search
Lana CodesWPVDB-ID:D3A0468A-8405-4B6C-800F-ABD5CE5387B5HistoryApr 26, 2023 - 12:00 a.m.
ClickFunnels <= 3.1.1 - Contributor+ Stored XSS via Shortcode
2023-04-2600:00:00
Lana Codes
wpscan.com
8
clickfunnels
version 3.1.1
contributor
stored xss
shortcode
attack
plugin
0.0004 Low
EPSS
Percentile
14.1%
The plugin does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
PoC
[clickfunnels_embed url=“javascript:alert(1)”]
| CPE | Name | Operator | Version |
|---|---|---|---|
| clickfunnels | eq | * |
Related
cvelist
cvelist
CVE-2022-4782 ClickFunnels <= 3.1.1 - Contributor+ Stored XSS via Shortcode
2023-08-16 11:03:19
wpexploit
wpexploit
ClickFunnels <= 3.1.1 - Contributor+ Stored XSS via Shortcode
2023-04-26 00:00:00
cve
cve
CVE-2022-4782
2023-08-16 12:15:11
prion
prion
Cross site scripting
2023-08-16 12:15:00
nvd
nvd
CVE-2022-4782
2023-08-16 12:15:11
wordfence
wordfence