Gilang

**Nome do Software Vulnerável e Versões Afetadas** ZeM STL plugin for WordPress versões anteriores a 1.1 **Description** O Cross-Site Scripting Armazenado é possível através do shortcode `[zemstl]` devido à sanitização de entrada e escape de saída insuficientes de atributos fornecidos pelo usuário. Especificamente, os parâmetros `url`, `color` e `bgcolor` são interpolados em contextos de atributos HTML sem serem processados por `esc attr()` ou funções de escape semelhantes. Isso permite que atacantes autenticados com nível de acesso de Colaborador ou superior injetem scripts web arbitrários em páginas, que são executados quando um usuário visita a página afetada. **Recommendations** Atualize o plugin para uma versão posterior a 1.0. Como mitigação temporária, restrinja a capacidade de usuários com nível de acesso de Colaborador de usar o shortcode `[zemstl]` ou modificar os parâmetros `url`, `color` e `bgcolor`.

The Responsive Video Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rem video' shortcode in versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes (notably 'id' and 'list') in the video shortcode() function, which are concatenated directly into an HTML iframe's src attribute without escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The jQuery googleslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'googleslides' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes (userid, albumid, authkey, imgmax, maxresults, random, caption, albumlink, time, and fadespeed) in the googleslides handler() function, which interpolates the attribute values directly into single-quoted HTML attributes without using esc attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Post Category Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'postcategorygallery' shortcode in versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes (such as total width, color scheme, and caption font size) inside the sc horcatbar() function, which are concatenated directly into HTML attribute values. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Single Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'single-mailchimp' shortcode in all versions up to, and including, 1.4. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes (autocomplete, label, placeholder, btn text, success msg, error msg) which are concatenated directly into HTML output by the single mailchimp() function in shortcodes.php. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Content Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Animate Your Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animation-set' shortcode in versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes in the shortcode args to html attrs() function, which concatenates shortcode attribute values directly into double-quoted HTML attributes without calling esc attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Events In City plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'org-events' shortcode in versions up to, and including, 3.0. This is due to insufficient input sanitization and output escaping on user supplied attributes (such as 'organizer id', 'width', 'height', 'transparency', 'header', 'border', and 'layout') in the org event scode() function. The attribute values are concatenated directly into HTML attributes without esc attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Name of the Vulnerable Software and Affected Versions** QuestionPro Surveys plugin for WordPress versions prior to 1.1 **Description** The QuestionPro Surveys plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'questionpro' shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update the QuestionPro Surveys plugin to version 1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Sphere Manager plugin for WordPress versions up to and including 1.0.2 **Description** The software is susceptible to Stored Cross-Site Scripting through the `width` parameter within the 'show sphere image' shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the Sphere Manager plugin to a version beyond 1.0.2.

**Name of the Vulnerable Software and Affected Versions** Simple Wp colorfull Accordion plugin for WordPress versions prior to 1.0 **Description** The Simple Wp colorfull Accordion plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `title` parameter within the 'accordion' shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. These scripts will execute whenever a user accesses the compromised page. **Recommendations** Update the Simple Wp colorfull Accordion plugin to a version newer than 1.0.

**Name of the Vulnerable Software and Affected Versions** Percent to Infograph plugin for WordPress versions prior to 1.1 **Description** The Percent to Infograph plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `percent to graph` shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. The `percent to graph` shortcode is the specific component affected. **Recommendations** Update to version 1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Citations tools plugin for WordPress versions up to and including 0.3.2 **Description** The Citations tools plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping on user-supplied attributes within the 'code' parameter of the 'ctdoi' shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the Citations tools plugin to a version newer than 0.3.2.

**Name of the Vulnerable Software and Affected Versions** Simple Plyr plugin for WordPress versions prior to 0.0.2 **Description** The Simple Plyr plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `poster` parameter within the 'plyr' shortcode. Insufficient input sanitization and output escaping of user-supplied attributes allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses the affected page. **Recommendations** Update the Simple Plyr plugin to version 0.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Docus – YouTube Video Playlist plugin for WordPress versions through 1.0.6 **Description** The Docus – YouTube Video Playlist plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `docusplaylist` shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the Docus – YouTube Video Playlist plugin to a version newer than 1.0.6.

**Nome do Software Vulnerável e Versões Afetadas** Versões do plugin WordPress Live Webcam Widget & Shortcode anteriores à 1.3 **Descrição** O plugin WordPress Live Webcam Widget & Shortcode está suscetível a Cross-Site Scripting Armazenado através do shortcode 'webcam'. A sanitização de entrada e o escape de saída insuficientes em atributos fornecidos pelo usuário permitem que atacantes autenticados com acesso de nível de colaborador ou superior injetem scripts web arbitrários nas páginas. Esses scripts serão executados quando um usuário acessar a página afetada. **Recomendações** Atualize o plugin WordPress Live Webcam Widget & Shortcode para a versão 1.3 ou posterior.

**Nome do Software Vulnerável e Versões Afetadas** Plugin A Simple Multilanguage versões anteriores à 1.0 **Descrição** O plugin A Simple Multilanguage para WordPress está suscetível a Cross-Site Scripting Armazenado através do shortcode 'asmp-switcher'. A sanitização insuficiente de entrada e o escape de saída em atributos fornecidos pelo usuário permitem que atacantes autenticados com acesso de nível de contribuidor ou superior injetem scripts web arbitrários nas páginas. Esses scripts serão executados quando um usuário acessar a página injetada. **Recomendações** Atualize o plugin A Simple Multilanguage para uma versão superior à 1.0.

**Nome do Software Vulnerável e Versões Afetadas** Plugin Fintelligence Calculator para WordPress, versões até e incluindo a 1.0.3 **Descrição** O plugin Fintelligence Calculator para WordPress é vulnerável a Cross-Site Scripting Armazenado através do shortcode 'fintelligence-calculator'. Isso se deve à sanitização de entrada e ao escape de saída inadequados dos atributos fornecidos pelo usuário. Atacantes autenticados com acesso de nível de colaborador ou superior podem injetar scripts web arbitrários nas páginas. Esses scripts serão executados quando um usuário acessar a página afetada. **Recomendações** Atualize o plugin Fintelligence Calculator para uma versão superior à 1.0.3.

**Name of the Vulnerable Software and Affected Versions** Event Tickets, RSVPs, Calendar versions up to and including 1.0.2 **Description** The Event Tickets, RSVPs, Calendar plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'ticket spot' shortcode. This is due to inadequate input sanitization and output escaping of user-provided attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update Event Tickets, RSVPs, Calendar to a version newer than 1.0.2.

**Nome do Software Vulnerável e Versões Afetadas** Versões do plugin Auto Bulb Finder for WordPress anteriores à 2.8.1 **Descrição** O plugin Auto Bulb Finder for WordPress está suscetível a Cross-Site Scripting Armazenado por meio do shortcode 'abf vehicle'. A sanitização insuficiente de entrada e o escape de saída em atributos fornecidos pelo usuário permitem que atacantes autenticados com acesso de nível de contribuidor ou superior injetem scripts web arbitrários nas páginas. Esses scripts serão executados quando um usuário acessar a página afetada. **Recomendações** Atualize o plugin Auto Bulb Finder for WordPress para a versão 2.8.1 ou posterior.