Jeremyshapiro
Monthly
Stored Cross-Site Scripting in Next Date WordPress plugin (all versions up to 1.0) allows authenticated contributors and above to inject arbitrary JavaScript into pages via the 'default' shortcode attribute due to insufficient input sanitization and output escaping. Injected scripts execute in the context of any user viewing the affected page, potentially compromising site visitors and administrators. No public exploit code or active exploitation has been identified at time of analysis.
The FuseDesk WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the fusedesk_newcase shortcode that fails to properly sanitize and escape the 'emailtext' attribute. Authenticated attackers with Contributor-level access or higher can inject malicious scripts into WordPress pages that execute for all subsequent visitors. The vulnerability affects all versions up to and including 6.8, with a CVSS score of 6.4 indicating moderate severity; no KEV or active exploitation data is currently documented, but the low attack complexity and network accessibility make this a meaningful concern for multi-user WordPress installations.
The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fusedesk_newcase' shortcode in all versions up to, and including, 6.6.1 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The URL Params WordPress plugin before 2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored Cross-Site Scripting in Next Date WordPress plugin (all versions up to 1.0) allows authenticated contributors and above to inject arbitrary JavaScript into pages via the 'default' shortcode attribute due to insufficient input sanitization and output escaping. Injected scripts execute in the context of any user viewing the affected page, potentially compromising site visitors and administrators. No public exploit code or active exploitation has been identified at time of analysis.
The FuseDesk WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the fusedesk_newcase shortcode that fails to properly sanitize and escape the 'emailtext' attribute. Authenticated attackers with Contributor-level access or higher can inject malicious scripts into WordPress pages that execute for all subsequent visitors. The vulnerability affects all versions up to and including 6.8, with a CVSS score of 6.4 indicating moderate severity; no KEV or active exploitation data is currently documented, but the low attack complexity and network accessibility make this a meaningful concern for multi-user WordPress installations.
The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fusedesk_newcase' shortcode in all versions up to, and including, 6.6.1 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The URL Params WordPress plugin before 2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.