未評価
XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This a...
CVE-2020-8498
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users (e.g., ones who have the publish_posts capability).
参照URL
- advisory github.com
- patch github.com
- patch wpvulndb.com