CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23833 – WordPress Drop Shadow Boxes Plugin <= 1.7.10 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-23833
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Steven Henty Drop Shadow Boxes plugin <= 1.7.10 versions. The Drop Shadow Boxes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 1.7.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/drop-shadow-boxes/wordpress-drop-shadow-boxes-plugin-1-7-10-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.1EPSS: 0%CPEs: 11EXPL: 0CVE-2013-0259
https://notcve.org/view.php?id=CVE-2013-0259
Cross-site scripting (XSS) vulnerability in the Boxes module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with administer or edit boxes permissions to inject arbitrary web script or HTML via the subject parameter. Ejecución de comandos en sitios cruzados (XSS) en el módulo Boxes v7.x-1.x antes v7.x-1.1 para Drupal que permite a usuarios remotos autenticados, con permiso para administrar o editar los permisos de las cajas, inyectar secuencias de comandos web o HTML a través del parámetro sujeto. • http://drupal.org/node/1897016 http://drupal.org/node/1903300 http://drupalcode.org/project/boxes.git/commitdiff/456ff8e http://www.openwall.com/lists/oss-security/2013/02/05/1 http://www.securityfocus.com/bid/57642 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •