CVE-2021-24541 – Wonder PDF Embed < 1.7 - Contributor+ Stored XSS

https://notcve.org/view.php?id=CVE-2021-24541

The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks. El plugin de WordPress Wonder PDF Embed versiones anteriores a 1.7, no escapa de los parámetros de su shortcode wonderplugin_pdf, que podría permitir a usuarios con un rol tan bajo como el de Contribuyente llevar a cabo ataques de tipo XSS Almacenado. • https://wpscan.com/vulnerability/e6602369-87f4-4454-8298-89cc69f8375c • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •