WordPress Plugin Vulnerabilities

VDZ CallBack < 1.1.4.6 - Authenticated Stored XSS

Description

The plugin does not properly sanitise or escape some of its settings, allowing high privilege users such as admin to perform XSS attacks even when the unfiltered_html capability is disallowed

Proof of Concept

Affects Plugins

Plugin icon
vdz-call-back
Fixed in 1.1.4.6

References

URL
https://plugins.trac.wordpress.org/changeset/2561770

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.8 (medium)

Miscellaneous

Verified
Yes
WPVDB ID
05bc41f4-8e32-4a9c-931b-cc99db0bb582

Timeline

Publicly Published
2021-07-10 (about 4 years ago)
Added
2021-07-19 (about 4 years ago)
Last Updated
2021-07-19 (about 4 years ago)

Other

Published
Title
Published
2022-07-18
Title
mTouch Quiz <= 3.1.3 - Admin+ Stored Cross Site Scripting
Published
2023-07-20
Title
Gestion-Pymes <= 1.5.6 - Admin+ Stored XSS
Published
2024-11-08
Title
Custom URL Shortener <= 0.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2022-05-10
Title
WPQA < 5.4 - Reflected Cross-Site Scripting
Published
2024-03-01
Title
Ebook Store < 5.8002 - Admin+ Stored XSS