Nail Majdeddine

**Nome do Software Vulnerável e Versões Afetadas** Extra Settings for RocketChat versões anteriores a 0.2 **Description** O plugin Extra Settings for RocketChat para WordPress contém um problema de Stored Cross-Site Scripting. Isso ocorre porque a função `rxstg shortcode()` não sanitiza adequadamente a entrada nem escapa a saída ao processar o atributo `title` do shortcode 'rocketchat', concatenando-o diretamente na saída HTML. Atacantes autenticados com nível de acesso de contribuidor ou superior podem explorar isso para injetar scripts web arbitrários em páginas, que são executados quando acessados por outros usuários. **Recommendations** Atualize o plugin para uma versão posterior a 0.1. Como medida paliativa temporária, restrinja o uso do atributo `title` dentro do shortcode 'rocketchat' para usuários com nível de acesso de contribuidor.

The Cryptocurrency Prijsvergelijking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0. This is due to insufficient output escaping in the as get coin shortcode() function, which renders the 'width' (and 'height') shortcode attribute directly into the style attribute of an <iframe> element without applying any escaping function such as esc attr(). An attacker-controlled value like '100px;"onload="alert(1)" x="' terminates the style attribute prematurely and injects an arbitrary HTML attribute into the iframe tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The GNTT Post Title Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0 via the `title-ticker-slide`, `title-ticker-fade`, and `title-ticker-typing` shortcodes. This is due to insufficient input sanitization and output escaping on shortcode attributes (notably `border`, `width`, `height`, `header background`, `header text color`, and `id`) within the `gntt title ticker slide()`, `gntt title ticker fade()`, and `gntt title ticker typing()` functions. None of these attribute values are passed through `esc attr()` or any other escaping function before being concatenated into HTML output. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The GBI To Print plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0 via the 'div' attribute of the 'gbitoprint' shortcode. This is due to insufficient output escaping in the gbi toprint shortcode() function, which concatenates the raw shortcode attribute value directly into an HTML attribute without applying esc attr() or any other sanitization. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Endless Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Google+ Link Name plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gplusnamelink' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes ('id' and 'name') in the gplusnamelink generate() function, which are concatenated directly into the rendered HTML without calling esc attr() or esc html(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Responsive Check plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rspcheck' shortcode in versions up to, and including, 0.0.3. This is due to insufficient input sanitization and output escaping on the 'url' (and 'button') shortcode attributes in the rspc check shortcode() function, which are echoed directly into iframe src attributes without esc attr() or esc url(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Islamic Database plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'islamicDB-roqya' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied 'width' and 'height' shortcode attributes within the islamicDB sc quran qari roqya() function, which are concatenated directly into HTML iframe attribute values. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Tuxquote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'TUXQUOTE' shortcode in versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes ('title', 'align', and 'width') in the tuxquote build format() function, which are concatenated into the rendered HTML without being passed through esc attr() or esc html(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Dideo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dideo' shortcode in version 1.0. This is due to insufficient input sanitization and output escaping on the 'id' shortcode attribute, which is interpolated directly into an HTML iframe 'src' attribute without escaping in the dideo() shortcode handler. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Voyage Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'post-content' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Credits Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the 'credits' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The scratchblocks for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'element' attribute of the 'scratchblocks' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Quick Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' attribute of the 'qtbl' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Nome do Software Vulnerável e Versões Afetadas** Simple Owl Shortcodes versões anteriores a 2.1.2 **Descrição** O plugin Simple Owl Shortcodes para WordPress contém um problema de Cross-Site Scripting (XSS) Armazenado. Isso ocorre devido à sanitização de entrada e escape de saída insuficientes de atributos fornecidos pelo usuário no shortcode 'owls wrapper', afetando especificamente o atributo `num`. Atacantes autenticados com nível de acesso de contribuidor ou superior podem injetar scripts web arbitrários em páginas, que são executados quando um usuário visita a página afetada. **Recomendações** Atualize para uma versão posterior a 2.1.1. Como medida paliativa temporária, restrinja o uso do atributo `num` no shortcode 'owls wrapper'.

**Name of the Vulnerable Software and Affected Versions** Simple Random Posts Shortcode versões anteriores a 0.4 **Description** O plugin Simple Random Posts Shortcode para WordPress contém um problema de Cross-Site Scripting Armazenado. Atacantes autenticados com nível de acesso de contribuidor ou superior podem injetar scripts web arbitrários em páginas. Isso ocorre porque o plugin não sanitiza adequadamente a entrada e não escapa a saída para o atributo `container right width` dentro do shortcode 'simple random posts'. Esses scripts são executados sempre que um usuário visita a página afetada. **Recommendations** Atualize o plugin para uma versão posterior a 0.3. Como medida paliativa temporária, restrinja o uso do atributo `container right width` no shortcode 'simple random posts'.

**Name of the Vulnerable Software and Affected Versions** Posts map plugin for WordPress versões anteriores a 0.1.4 **Description** A sanitização insuficiente de entrada e a escape de saída inadequada em atributos fornecidos pelo usuário permitem que atacantes autenticados com nível de acesso de contribuidor ou superior injetem scripts web arbitrários. Isso ocorre por meio do atributo de shortcode 'name', resultando em scripts que são executados sempre que um usuário acessa uma página injetada. Stored Cross-Site Scripting é uma falha onde um script malicioso é armazenado permanentemente no servidor alvo. **Recommendations** Atualize o plugin para uma versão posterior a 0.1.3.

**Name of the Vulnerable Software and Affected Versions** SlideShowPro SC versões anteriores a 1.0.3 **Description** O plugin SlideShowPro SC para WordPress contém um problema de Stored Cross-Site Scripting. Isso ocorre devido à sanitização de entrada e escape de saída insuficientes em atributos fornecidos pelo usuário no shortcode `slideShowProSC`. Atacantes autenticados com nível de acesso de contribuidor ou superior podem injetar scripts web arbitrários em páginas, que são executados quando um usuário visita a página afetada. **Recommendations** Atualize o plugin para uma versão posterior a 1.0.2.

**Name of the Vulnerable Software and Affected Versions** Text Snippets versões anteriores a 0.0.2 **Description** O plugin Text Snippets para WordPress contém um problema de Stored Cross-Site Scripting. Isso ocorre devido à sanitização de entrada e escape de saída insuficientes em atributos fornecidos pelo usuário no shortcode `ts`. Atacantes autenticados com nível de acesso de contribuidor ou superior podem injetar scripts web arbitrários em páginas, que são executados quando um usuário visita a página afetada. **Recommendations** Atualize para uma versão posterior a 0.0.1.

**Name of the Vulnerable Software and Affected Versions** VI: Include Post By versões anteriores a 0.4.200706 **Description** Ocorre Cross-Site Scripting Armazenado devido à sanitização de entrada e escape de saída insuficientes em atributos fornecidos pelo usuário. Atacantes autenticados com nível de acesso de contribuidor ou superior podem injetar scripts web arbitrários através do atributo `class container` do shortcode 'include-post-by-cat'. Esses scripts são executados sempre que um usuário acessa uma página afetada. **Recommendations** Atualize para uma versão posterior a 0.4.200706.