Slideshowpro Sc
Monthly
Stored cross-site scripting (XSS) in SlideShowPro SC plugin for WordPress versions up to 1.0.2 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript through the `slideShowProSC` shortcode attributes due to insufficient input sanitization and output escaping. The injected scripts execute in the context of any user viewing the affected page, potentially compromising session tokens, stealing credentials, or performing unauthorized actions on behalf of site visitors. No public exploit code or active exploitation has been confirmed at the time of analysis.
Stored cross-site scripting (XSS) in SlideShowPro SC plugin for WordPress versions up to 1.0.2 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript through the `slideShowProSC` shortcode attributes due to insufficient input sanitization and output escaping. The injected scripts execute in the context of any user viewing the affected page, potentially compromising session tokens, stealing credentials, or performing unauthorized actions on behalf of site visitors. No public exploit code or active exploitation has been confirmed at the time of analysis.