Ecover Builder For Dummies
Monthly
The Ecover Builder For Dummies WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'id' parameter of the 'ecover' shortcode due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that persists in page content and executes for all users viewing the affected page. With a CVSS score of 6.4 and confirmed by Wordfence, this vulnerability enables privilege escalation and defacement attacks within WordPress environments.
The Ecover Builder For Dummies WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'id' parameter of the 'ecover' shortcode due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that persists in page content and executes for all users viewing the affected page. With a CVSS score of 6.4 and confirmed by Wordfence, this vulnerability enables privilege escalation and defacement attacks within WordPress environments.