WordPress Plugin Vulnerabilities

Clicky by Yoast <= 1.5 - Minor Security Improvements

Description

From the changelog:

- Only allow expected characters in user settings thanks to a report by Netsparker.
- Proper escaping of translated string in image attributes.

Affects Plugins

Plugin icon
clicky
Fixed in 1.6

References

URL
https://www.netsparker.com/web-applications-advisories/ns-16-008-multiple-stored-xss-vulnerability-identified-in-clicky-by-yoast-1-4-3/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
b077f226-36a1-49a5-9d33-31e2200234f5

Timeline

Publicly Published
2016-07-29 (about 9 years ago)
Added
2016-07-29 (about 9 years ago)
Last Updated
2019-11-01 (about 6 years ago)

Other

Published
Title
Published
2024-05-13
Title
Essential Addons for Elementor < 5.9.21 - Contributor+ Stored Cross-Site Scripting
Published
2021-08-13
Title
jQuery Tagline Rotator <= 0.1.5 - Reflected Cross-Site Scripting
Published
2025-12-11
Title
Reviews Sorted <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'space' Shortcode Attribute
Published
2024-11-13
Title
Linear < 2.8.1 - Contributor+ Stored XSS
Published
2014-08-01
Title
wp-topbar <= 3.04 - XSS in ZeroClipboard.swf