Embed Privacy missing escaping for show_all attribute in opt-out shortcode
Résumé
Embed Privacy missing escaping for show_all attribute in opt-out shortcode
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The Embed Privacy plugin for WordPress that prevents the loading of embedded external content is vulnerable to Stored Cross-Site Scripting via embed_privacy_opt_out shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Version 1.8.1 contains a patch for this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- report github.com
- web d.pr