Switch Cta Box
Monthly
Stored Cross-Site Scripting in Switch CTA Box WordPress plugin up to version 1.1 allows authenticated contributors and above to inject arbitrary JavaScript through unsanitized post meta fields including button link, button ID, button text, and description. The vulnerability arises from direct output of user-supplied data into HTML without escaping functions, enabling attackers to execute malicious scripts whenever pages containing injected shortcodes are accessed by any visitor.
Stored Cross-Site Scripting in Switch CTA Box WordPress plugin up to version 1.1 allows authenticated contributors and above to inject arbitrary JavaScript through unsanitized post meta fields including button link, button ID, button text, and description. The vulnerability arises from direct output of user-supplied data into HTML without escaping functions, enabling attackers to execute malicious scripts whenever pages containing injected shortcodes are accessed by any visitor.