Vi
Monthly
Stored Cross-Site Scripting in VI: Include Post By WordPress plugin up to version 0.4.200706 allows authenticated contributors and above to inject arbitrary JavaScript via the 'class_container' shortcode attribute, which executes in the browsers of any user viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied shortcode parameters. No public exploit code or active exploitation has been reported; however, the low attack complexity and broad scope of impact (affecting all site visitors) make this a moderate-priority issue for WordPress installations using this plugin.
Stored Cross-Site Scripting in VI: Include Post By WordPress plugin up to version 0.4.200706 allows authenticated contributors and above to inject arbitrary JavaScript via the 'class_container' shortcode attribute, which executes in the browsers of any user viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied shortcode parameters. No public exploit code or active exploitation has been reported; however, the low attack complexity and broad scope of impact (affecting all site visitors) make this a moderate-priority issue for WordPress installations using this plugin.