Bootstrap Shortcodes
Monthly
Stored cross-site scripting in the Bootstrap Shortcodes plugin for WordPress before 3.4.6 allows authenticated users with Contributor-level access or higher to inject arbitrary web script through a crafted id attribute in the [bs_tcontent] shortcode, which is rendered into an unquoted HTML attribute; a victim must view the page and interact with the injected element for the script to execute. The issue is rated CVSS 5.1 and there is no public exploit identified at time of analysis; the vendor has released version 3.4.6 with a fix that quotes the attribute.
Stored cross-site scripting in the Bootstrap Shortcodes plugin for WordPress before 3.4.6 allows authenticated users with Contributor-level access or higher to inject arbitrary web script through a crafted id attribute in the [bs_tcontent] shortcode, which is rendered into an unquoted HTML attribute; a victim must view the page and interact with the injected element for the script to execute. The issue is rated CVSS 5.1 and there is no public exploit identified at time of analysis; the vendor has released version 3.4.6 with a fix that quotes the attribute.