Wufoo Shortcode
Monthly
Stored Cross-Site Scripting in the Wufoo Shortcode WordPress plugin (versions 1.55 and earlier) allows authenticated Contributor-level users to inject persistent malicious JavaScript through the plugin's shortcode functionality. When a higher-privileged user - typically an administrator or editor - views the affected post or page, the script executes in their browser session, crossing the security boundary established by WordPress role separation. No public exploit code or active exploitation has been identified at time of analysis; however, the CVSS Scope:Changed metric confirms the impact extends beyond the contributor's own session.
Stored Cross-Site Scripting in the Wufoo Shortcode WordPress plugin (versions 1.55 and earlier) allows authenticated Contributor-level users to inject persistent malicious JavaScript through the plugin's shortcode functionality. When a higher-privileged user - typically an administrator or editor - views the affected post or page, the script executes in their browser session, crossing the security boundary established by WordPress role separation. No public exploit code or active exploitation has been identified at time of analysis; however, the CVSS Scope:Changed metric confirms the impact extends beyond the contributor's own session.