Scoreboard For Html5 Games Lite
Monthly
This is a Stored Cross-Site Scripting (XSS) vulnerability in the Scoreboard for HTML5 Games Lite WordPress plugin affecting all versions up to and including 1.2. The vulnerability exists in the sfhg_shortcode() function, which insufficiently validates HTML attributes added to iframe elements, allowing authenticated attackers with Contributor-level access or above to inject arbitrary JavaScript that executes when users view affected pages. The vulnerability has a CVSS score of 6.4 with medium real-world risk, as it requires authenticated access but affects stored content with site-wide impact.
This is a Stored Cross-Site Scripting (XSS) vulnerability in the Scoreboard for HTML5 Games Lite WordPress plugin affecting all versions up to and including 1.2. The vulnerability exists in the sfhg_shortcode() function, which insufficiently validates HTML attributes added to iframe elements, allowing authenticated attackers with Contributor-level access or above to inject arbitrary JavaScript that executes when users view affected pages. The vulnerability has a CVSS score of 6.4 with medium real-world risk, as it requires authenticated access but affects stored content with site-wide impact.