rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-4753 Print-O-Matic < 2.1.8 - Contributor+ Stored XSS via Shortcode
The Print-O-Matic WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Print-O-Matic
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-23T14:31:48.865Z
CVE-2022-4754 Easy Social Box <= 4.1.2 - Contributor+ Stored XSS via Shortcode
The Easy Social Box / Page Plugin WordPress plugin through 4.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Easy Social Box / Page Plugin
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-21T08:51:03.803Z
CVE-2022-4755 FlatPress Media Manager Plugin panel.mediamanager.file.php main cross site scripting
A vulnerability was found in FlatPress and classified as problematic. This issue affects the function main of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component Media Manager Plugin. The manipulation of the argument mm-newgallery-name leads to cross site scripting. The attack may be initiated remotely. The name of the patch is d3f329496536dc99f9707f2f295d571d65a496f5. It is recommended to apply a patch to fix this issue. The identifier VDB-216869 was assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: n/a
product: FlatPress
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Published: 2022-12-27T09:39:11.575Z
CVE-2022-4756 YouTube Channel < 3.23.0 - Contributor+ Stored XSS via Shortcode
The My YouTube Channel WordPress plugin before 3.23.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: My YouTube Channel
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-06T19:59:14.149Z
CVE-2022-4757 List Pages Shortcode < 1.7.6 - Contributor+ Stored XSS via Shortcode
The List Pages Shortcode WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: List Pages Shortcode
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-27T15:24:30.431Z
CVE-2022-4758 10WebMapBuilder < 1.0.72 - Contributor+ Stored XSS via Shortcode
The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: 10WebMapBuilder
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-23T14:31:52.942Z
CVE-2022-4759 GigPress < 2.3.28 - Contributor+ Stored XSS via Shortcode
The GigPress WordPress plugin before 2.3.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: GigPress
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:34.943Z
CVE-2022-4760 OneClick Chat to Order < 1.0.4.2 - Contributor+ Stored XSS via Shortcode
The OneClick Chat to Order WordPress plugin before 1.0.4.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: OneClick Chat to Order
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-23T14:31:24.112Z
CVE-2022-4761 Post Views Count <= 3.0.2 - Contributor+ Stored XSS in Shortcode
The Post Views Count WordPress plugin through 3.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Post Views Count (Support caching plugins!)
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-21T08:50:44.527Z
CVE-2022-4762 Materialis Companion < 1.3.40 - Contributor+ Stored XSS via Shortcode
The Materialis Companion WordPress plugin before 1.3.40 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Materialis Companion
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-06T19:59:44.591Z
CVE-2022-4763 Icon Widget < 1.3.0 - Contributor+ Stored XSS via Shortcode
The Icon Widget WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Icon Widget
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-30T20:31:57.998Z
CVE-2022-4764 Simple File Downloader <= 1.0.4 - Contributor+ Stored XSS via Shortcode
The Simple File Downloader WordPress plugin through 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple File Downloader
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-21T08:50:55.747Z
CVE-2022-4765 Portfolio for Elementor, Image Gallery & Post Grid | PowerFolio < 2.3.1 - Contributor+ Stored XSS via Shortcode
The Portfolio for Elementor WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Portfolio for Elementor, Image Gallery & Post Grid  | PowerFolio
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-30T20:31:50.977Z
CVE-2022-4766 dolibarr_project_timesheet Form cross-site request forgery
A vulnerability was found in dolibarr_project_timesheet up to 4.5.5. It has been declared as problematic. This vulnerability affects unknown code of the component Form Handler. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. Upgrading to version 4.5.6.a is able to address this issue. The name of the patch is 082282e9dab43963e6c8f03cfaddd7921de377f4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216880.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery
Affected products: vendor: n/a
product: dolibarr_project_timesheet
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Published: 2022-12-27T12:14:13.299Z
CVE-2022-4767 Denial of Service in usememos/memos
Denial of Service in GitHub repository usememos/memos prior to 0.9.1.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-27T00:00:00.000Z
CVE-2022-4768 Dropbox merou SSH Public Key public_key.py add_public_key injection
A vulnerability was found in Dropbox merou. It has been classified as critical. Affected is the function add_public_key of the file grouper/public_key.py of the component SSH Public Key Handler. The manipulation of the argument public_key_str leads to injection. It is possible to launch the attack remotely. The name of the patch is d93087973afa26bc0a2d0a5eb5c0fde748bdd107. It is recommended to apply a patch to fix this issue. VDB-216906 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-74
description: CWE-74 Injection
Affected products: vendor: Dropbox
product: merou
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Published: 2022-12-27T22:33:35.180Z
CVE-2022-4769 Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information 

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is uploaded with an invalid character in its name. 


Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: Hitachi Vantara
product: Pentaho Business Analytics Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Hitachi Group Member 
Published: 2023-04-03T18:53:51.840Z
CVE-2022-4770 Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information 

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt). 


Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: Hitachi Vantara
product: Pentaho Business Analytics Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Hitachi Group Member
Published: 2023-04-03T18:56:17.800Z
CVE-2022-4771 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow a malicious URL to inject content into the Pentaho User Console through session variables. 


Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Hitachi Vantara
product: Pentaho Business Analytics Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Hitachi Group Member
Published: 2023-04-03T18:58:44.148Z
CVE-2022-4772 Widoco WidocoUtils.java unZipIt path traversal
A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is f2279b76827f32190adfa9bd5229b7d5a147fa92. It is recommended to apply a patch to fix this issue. VDB-216914 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-22
description: CWE-22 Path Traversal
Affected products: vendor: n/a
product: Widoco
CVSS v3.1: version: 3.1
baseScore: 4.5
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Published: 2022-12-27T22:47:46.170Z
CVE-2022-4773 cloudsync LocalFilesystemConnector.java getItem path traversal
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in cloudsync. Affected by this vulnerability is the function getItem of the file src/main/java/cloudsync/connector/LocalFilesystemConnector.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is 3ad796833398af257c28e0ebeade68518e0e612a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216919. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: cwe_id: CWE-22
description: CWE-22 Path Traversal
Affected products: vendor: n/a
product: cloudsync
CVSS v3.1: version: 3.1
baseScore: 2.5
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: LOW
Published: 2022-12-27T23:05:37.534Z
CVE-2022-4774 Bit Form < 1.9 - RCE via Unauthenticated Arbitrary File Upload
The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated users to upload arbitrary files types such as PHP or HTML files to the server, leading to Remote Code Execution.
Problem types: description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: Bit Form
default_status: unaffected
Credits: lang: en
value: Felipe Restrepo Rodríguez
lang: en
value: WPScan
Published: 2023-05-15T12:15:44.681Z
CVE-2022-4775 GeoDirectory < 2.2.22 - Contributor+ Stored XSS via Shortcode
The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: GeoDirectory
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-23T14:32:01.696Z
CVE-2022-4776 CC Child Pages < 1.43 - Contributor+ Stored XSS via Shortcode
The CC Child Pages WordPress plugin before 1.43 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: CC Child Pages
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-30T20:31:29.828Z
CVE-2022-4777 Bootstrap Shortcodes <= 3.4.0 - Contributor+ Stored XSS via Shortcode
The Bootstrap Shortcodes WordPress plugin through 3.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Bootstrap Shortcodes
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-21T08:50:42.128Z
CVE-2022-4778 path traversal in elvexys StreamX using StreamView HTML component with public web server feature
StreamX applications from versions 6.02.01 to 6.04.34 are affected by a path traversal vulnerability that allows authenticated users to get unauthorized access to files on the server's filesystem.
StreamX applications using StreamView HTML component with the public web server feature activated are affected.
Problem types: description: n/a
Affected products: vendor: elvexys
product: StreamX
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Damian Pfammatter, Cyber-Defense Campus, armasuisse S+T
lang: en
value: Daniel Hulliger, Cyber-Defense Campus, armasuisse S+T
Published: 2022-12-28T14:20:24.269Z
CVE-2022-4779 authentication bypass in elvexys StreamX using StreamView HTML component with public web server feature
StreamX applications from versions 6.02.01 to 6.04.34 are affected by a logic bug that allows to bypass the implemented authentication scheme.
StreamX applications using StreamView HTML component with the public web server feature activated are affected. 
Problem types: description: n/a
Affected products: vendor: elvexys
product: StreamX
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Damian Pfammatter, Cyber-Defense Campus, armasuisse S+T
lang: en
value: Daniel Hulliger, Cyber-Defense Campus, armasuisse S+T
Published: 2022-12-28T14:20:49.370Z
CVE-2022-4780 hard coded credentials in elvexys ISOS firmwares
ISOS firmwares from versions 1.81 to 2.00 contain hardcoded credentials from embedded StreamX installer that integrators are not forced to change.

Problem types: description: n/a
Affected products: vendor: elvexys
product: ISOS
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Damian Pfammatter, Cyber-Defense Campus, armasuisse S+T
lang: en
value: Daniel Hulliger, Cyber-Defense Campus, armasuisse S+T
Published: 2022-12-28T14:21:36.185Z
CVE-2022-4781 Accordion Shortcodes <= 2.4.2 - Contributor+ Stored XSS via Shortcode
The Accordion Shortcodes WordPress plugin through 2.4.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Accordion Shortcodes
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-30T20:31:52.742Z
CVE-2022-4782 ClickFunnels <= 3.1.1 - Contributor+ Stored XSS via Shortcode
The ClickFunnels WordPress plugin through 3.1.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: ClickFunnels
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-08-16T11:03:19.513Z
CVE-2022-4783 Youtube Channel Gallery <= 2.4 - Contributor+ Stored XSS via Shortcode
The Youtube Channel Gallery WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Youtube Channel Gallery
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:00.140Z
CVE-2022-4784 Hueman Addons <= 2.3.3 - Contributor+ Stored XSS via Shortcode
The Hueman Addons WordPress plugin through 2.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Hueman Addons
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-21T08:50:50.067Z
CVE-2022-4785 Download Video Sidebar Widgets <= 6.1 - Contributor+ Stored XSS via Shortcode
The Video Sidebar Widgets WordPress plugin through 6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Video Sidebar Widgets
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-21T08:50:46.088Z
CVE-2022-4786 Video.js - HTML5 Video Player for WordPress <= 4.5.0 - Contributor+ Stored XSS via Shortcode
The Video.js WordPress plugin through 4.5.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Video.js
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-21T08:50:58.955Z