Text Snippets
Monthly
Stored cross-site scripting (XSS) in the Text Snippets plugin for WordPress up to version 0.0.1 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript into pages via unsanitized shortcode attributes, which executes whenever any user visits the affected page. The vulnerability stems from insufficient input sanitization and output escaping on the `ts` shortcode, enabling persistent payload injection. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting (XSS) in the Text Snippets plugin for WordPress up to version 0.0.1 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript into pages via unsanitized shortcode attributes, which executes whenever any user visits the affected page. The vulnerability stems from insufficient input sanitization and output escaping on the `ts` shortcode, enabling persistent payload injection. No public exploit code or active exploitation has been identified at time of analysis.