Lucene search

K
wpvulndbWpvulndbWPVDB-ID:FDFA7172-643C-4DCB-BDF5-37EE034F8367
HistoryOct 25, 2023 - 12:00 a.m.

WP Font Awesome <= 1.7.9 - Contributor+ Stored Cross-Site Scripting via Shortcode

2023-10-2500:00:00
wpscan.com
10
plugin
validate
escape
shortcode
attributes
outputting
page
contributor
stored cross-site scripting
attacks
high-privilege
admins

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

36.5%

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back into the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins.

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

36.5%

Related for WPVDB-ID:FDFA7172-643C-4DCB-BDF5-37EE034F8367