DearFlip < 2.2.27 - Contributor+ Stored XSS

2024-02-0200:00:00

wpscan.com

vulnerable

stored cross-site scripting

contributor-level permissions

input sanitization

output escaping

web scripts

plugin vulnerability

authenticated attackers

user supplied data

insufficient sanitization

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.2%

JSON

Description The plugin is vulnerable to Stored Cross-Site Scripting via outline settings due to insufficient input sanitization and output escaping on user supplied data, allowing authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.