Breeze < 2.1.4 - Admin+ Stored XSS

2024-03-2900:00:00

wpscan.com

breeze plugin

stored xss

admin privilege

cross-site scripting

multisite setup

5.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.9%

JSON

Description The plugin does not sanitise and escape its breeze_api_token settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)