The Custom Content Shortcode WordPress plugin before 4.0.2 does not escape custom fields before outputting them, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed. Please note that such attack is still possible by admin+ in single site blogs by default (but won't be when the unfiltered_html is disallowed)
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/e247d78a-7243-486c-a017-7471a8dcb800 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2022-03-07 09:15
Updated : 2024-02-28 19:09
NVD link : CVE-2021-24826
Mitre link : CVE-2021-24826
CVE.ORG link : CVE-2021-24826
JSON object : View
Products Affected
custom_content_shortcode_project
- custom_content_shortcode
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')