WordPress Plugin Vulnerabilities

Shariff for WordPress <= 1.0.7 - Stored Cross-Site Scripting (XSS)

Description

On the "Settings > Shariff" screen, the input field 'shariff_image' is saved without any validation. Malicious JavaScript can be injected.

Screenshots:

http://imgur.com/hipNRLW
http://imgur.com/N6djVaE

Affects Plugins

Plugin icon
shariff-sharing
Fixed in 1.0.8

References

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Submitter
SecuBeastTeam
Verified
No
WPVDB ID
0cb40494-65d3-4a27-8abc-475ae21f483c

Timeline

Publicly Published
2014-12-05 (about 11 years ago)
Added
2014-12-05 (about 11 years ago)
Last Updated
2019-10-21 (about 6 years ago)

Other

Published
Title
Published
2020-10-22
Title
CM Download Manager < 2.8.0 - Authenticated Cross-Site Scripting
Published
2024-01-17
Title
Essential Addons for Elementor < 5.9.5 - Contributor+ Stored Cross-Site Scritping
Published
2024-06-06
Title
YITH Custom Login < 1.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2024-09-30
Title
WP MyLinks < 1.0.7 - Authenticated (Editor+) Stored Cross-Site Scripting
Published
2022-02-14
Title
YOP Poll < 6.3.5 - Author+ Stored Cross-Site Scripting