CVE-2021-24540 – Wonder Video Embed < 1.8 - Contributor+ Stored XSS

https://notcve.org/view.php?id=CVE-2021-24540

The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks. El plugin de WordPress Wonder Video Embed versiones anteriores a 1.8, no escapa de los parámetros de su shortcode wonderplugin_video, que podría permitir a usuarios con un rol tan bajo como el de Contributor llevar a cabo ataques de tipo XSS Almacenado. • https://wpscan.com/vulnerability/67910e5d-ea93-418b-af81-c50d0e05d213 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •