WordPress Plugin Vulnerabilities

Buttons Shortcode and Widget <= 1.16 - Stored XSS via shortcode

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

Affects Plugins

Plugin icon
buttons-shortcode-and-widget
No known fix

References

CVE
CVE-2024-0711

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Submitter
Dmitrii Ignatyev
Submitter website
https://research.cleantalk.org
Verified
Yes
WPVDB ID
8e286c04-ef32-4af0-be78-d978999b2a90

Timeline

Publicly Published
2024-02-20 (about 1 year ago)
Added
2024-02-20 (about 1 year ago)
Last Updated
2024-02-20 (about 1 year ago)

Other

Published
Title
Published
2023-02-02
Title
EZP Coming Soon Page < 1.0.7.4 - Admin+ Stored XSS
Published
2025-08-18
Title
Flexible Maps < 1.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flexible Maps Shortcode
Published
2015-09-15
Title
WordPress <= 4.3 - Authenticated Shortcode Tags Cross-Site Scripting (XSS)
Published
2025-01-06
Title
Infility Global < 2.9.9 - Reflected XSS via set_type Parameter
Published
2024-05-22
Title
ProfilePress < 4.15.9 - Contributor+ Stored XSS