1 results (0.001 seconds)

CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1

The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed El plugin Event Timeline de WordPress versiones hasta 1.1.5, no sanea ni escapa del texto de la línea de tiempo, lo que podría permitir a usuarios con altos privilegios, como el administrador, llevar a cabo ataques de tipo Cross-Site Scripting incluso cuando unfiltered_html está deshabilitado The Event Timeline WordPress plugin through 1.1.6 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed • https://wpscan.com/vulnerability/2ce2a387-acc8-482a-9452-a4d9acb187fd • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •