CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22162 – WordPress WPZOOM Shortcodes Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2024-22162
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Shortcodes allows Reflected XSS.This issue affects WPZOOM Shortcodes: from n/a through 1.0.1. La vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('cross-site Scripting') en WPZOOM Shortcodes permite XSS reflejado. Este problema afecta a WPZOOM Shortcodes: desde n/a hasta 1.0.1. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Shortcodes allows Reflected XSS.This issue affects WPZOOM Shortcodes: from n/a through 1.0.3. The WPZOOM Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via certain input fields in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. • https://patchstack.com/database/vulnerability/wpzoom-shortcodes/wordpress-wpzoom-shortcodes-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4763 – Icon Widget < 1.3.0 - Contributor+ Stored XSS via Shortcode
https://notcve.org/view.php?id=CVE-2022-4763
The Icon Widget WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. The Icon Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page • https://wpscan.com/vulnerability/2f79a87f-c994-4a1e-b455-39d7d3c5c1b5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4789 – WPZOOM Portfolio < 1.2.2 - Contributor+ Stored XSS via Shortcode
https://notcve.org/view.php?id=CVE-2022-4789
The WPZOOM Portfolio WordPress plugin before 1.2.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. El complemento WPZOOM Portfolio WordPress anterior a 1.2.2 no valida ni escapa uno de sus atributos de código corto, lo que podría permitir a los usuarios con un rol tan bajo como colaborador realizar un ataque de cross-site scripting almacenado. The WPZOOM Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page • https://wpscan.com/vulnerability/5e816e9a-84e5-42d2-a7ff-e46be9072278 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2391 – Inspiro Pro < 7.2.3 - Contributor+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-2391
The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript into the description. El plugin Inspiro PRO de WordPress no sanea la descripción del slider del portafolio, permitiendo a usuarios con privilegios tan bajos como Contributor inyectar JavaScript en la descripción The Inspiro Pro theme for WordPress is vulnerable to Stored Cross-Site Scripting via the description area in versions up to, and including, 7.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/dd6ebf6b-209b-437c-9fe4-527ab9e3b9e3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24634 – Recipe Card Blocks < 2.8.3 - Contributor+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-24634
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings), which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks. El plugin Recipe Card Blocks by WPZOOM de WordPress versiones anteriores a 2.8.3, no sanea o escapa correctamente de algunas propiedades del Recipe Card Block (como ingredientsLayout, iconSet, steps, ingredients, recipeTitle, o settings), lo que podría permitir a usuarios con un rol tan bajo como el de contribuidor llevar a cabo ataques de tipo Cross-Site Scripting Almacenado The Recipe Card Blocks by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.8.2 by not properly sanitizing or escaping some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings). This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/a49c5a5b-57c0-4801-8bf1-cd3a05b12288 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •