CVE-2021-24416 – StreamCast < 2.1.1 - Contributor+ Stored Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2021-24416

The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode El plugin StreamCast - Radio Player de WordPress versiones anteriores a 2.1.1, no sanea ni comprueba los parámetros de su shortcode, permitiendo a usuarios con un rol tan bajo como el de colaborador establecer en ellos cargas útiles de tipo Cross-Site Scripting que será desencadenada en la/s página/s con el shortcode malicioso insertado • https://wpscan.com/vulnerability/260c7e2d-d48c-42d6-ae05-bad3f3bac01d • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •