PT-2025-17859 · WordPress · Breeze Display
CVSS v3.1
6.4
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Breeze Display plugin for WordPress versions up to, and including, 1.2.3
Description
The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The
cal size parameter is specifically vulnerable to this type of attack.Recommendations
For Breeze Display plugin for WordPress versions up to, and including, 1.2.3, consider updating to a version that addresses the insufficient input sanitization and output escaping issue. As a temporary workaround, restrict access to the
cal size parameter to minimize the risk of exploitation. Avoid using the cal size parameter in affected pages until the issue is resolved.Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Breeze Display