Dj

**Name of the Vulnerable Software and Affected Versions** CM Business Directory versions prior to 1.5.8 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs when arbitrary web scripts are injected into pages via business address meta fields, which then execute when a user accesses the affected page. Because the payload is stored in post meta instead of post content, the WordPress `unfiltered html` capability restriction is bypassed. The affected variables include `cmbd address`, `cmbd cityTown`, `cmbd stateCounty`, `cmbd postalcode`, `cmbd region`, and `cmbd country`. **Recommendations** Update to a version newer than 1.5.7. Restrict the use of the `cmbd address`, `cmbd cityTown`, `cmbd stateCounty`, `cmbd postalcode`, `cmbd region`, and `cmbd country` fields to trusted users only.

**Name of the Vulnerable Software and Affected Versions** WP Photo Album Plus versions prior to 9.1.13.006 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. An attacker can inject arbitrary web scripts into pages by embedding a malicious `[photo]` shortcode in a post submitted for review. These scripts execute when an administrator or any other user views the affected page. The issue is triggered via the `subtext` parameter. **Recommendations** Update WP Photo Album Plus to version 9.1.13.006 or later.

**Name of the Vulnerable Software and Affected Versions** Event Organiser versions prior to 3.13.0 **Description** The Event Organiser plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `eo events` shortcode accepts attacker-controlled `no events` content and renders it in event list templates without proper output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update the plugin to a version later than 3.12.9.

**Name of the Vulnerable Software and Affected Versions** FV Flowplayer Video Player versions prior to 7.5.51.722 **Description** Stored Cross-Site Scripting (XSS) occurs due to insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `align` attribute of the `video player` shortcode. These scripts execute whenever a user visits the affected page. **Recommendations** Update to a version newer than 7.5.51.7212. As a temporary mitigation, restrict the ability of users with contributor-level access to edit pages or use the `video player` shortcode.

Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions.

**Name of the Vulnerable Software and Affected Versions** Canvas plugin for WordPress versions prior to 2.5.3 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts via the `tag` parameter. These scripts execute whenever a user accesses the affected page. **Recommendations** Update the plugin to a version later than 2.5.2. As a temporary workaround, restrict access to the `tag` parameter for users with contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** ZeM STL plugin for WordPress versions prior to 1.1 **Description** Stored Cross-Site Scripting is possible via the `[zemstl]` shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. Specifically, the `url`, `color`, and `bgcolor` parameters are interpolated into HTML attribute contexts without being processed by `esc attr()` or similar escaping functions. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update the plugin to a version later than 1.0. As a temporary mitigation, restrict the ability of users with Contributor-level access to use the `[zemstl]` shortcode or modify the `url`, `color`, and `bgcolor` parameters.

**Name of the Vulnerable Software and Affected Versions** Simple Divi Shortcode versions prior to 1.3 **Description** The Simple Divi Shortcode plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `showmodule shortcode()` function fails to properly sanitize input and escape output when handling the `id` parameter of the `[showmodule]` shortcode. The `id` attribute is concatenated directly into a dynamically constructed shortcode string without using `esc attr()` or other escaping methods, allowing an attacker to break the attribute context and inject arbitrary HTML. Authenticated attackers with contributor-level access or higher can inject malicious web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update to a version later than 1.2. As a temporary workaround, restrict the use of the `id` parameter within the `[showmodule]` shortcode or limit user permissions to prevent contributors from editing pages with this shortcode.

The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headline' parameter in the [shariff] shortcode in all versions up to, and including, 4.6.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability occurs because the plugin uses a custom wp kses implementation with permissive allowed HTML tags, and then performs a str replace operation that injects HTML after sanitization, allowing event handlers to be introduced through the %total placeholder in the style attribute.

The Single Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'single-mailchimp' shortcode in all versions up to, and including, 1.4. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes (autocomplete, label, placeholder, btn text, success msg, error msg) which are concatenated directly into HTML output by the single mailchimp() function in shortcodes.php. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Post Category Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'postcategorygallery' shortcode in versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes (such as total width, color scheme, and caption font size) inside the sc horcatbar() function, which are concatenated directly into HTML attribute values. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Livemesh Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `labb admin ajax` AJAX action in all versions up to, and including, 3.9.2 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce but does not check user capabilities. This makes it possible for authenticated attackers with Subscriber-level access and above to modify plugin settings and inject malicious scripts that execute when administrators access the plugin settings page or when any user visits the frontend.

**Name of the Vulnerable Software and Affected Versions** Query Shortcode versions prior to 0.2.2 **Description** The Query Shortcode plugin for WordPress contains a Local File Inclusion issue within the shortcode function. Authenticated attackers with contributor-level access or higher can exploit this by using the `lens` shortcode attribute to include and execute arbitrary .php files on the server. This allows for the execution of PHP code, which can be used to bypass access controls or obtain sensitive data, particularly when .php files can be uploaded to the server. **Recommendations** Update the plugin to a version later than 0.2.1.

The jQuery googleslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'googleslides' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes (userid, albumid, authkey, imgmax, maxresults, random, caption, albumlink, time, and fadespeed) in the googleslides handler() function, which interpolates the attribute values directly into single-quoted HTML attributes without using esc attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Events In City plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'org-events' shortcode in versions up to, and including, 3.0. This is due to insufficient input sanitization and output escaping on user supplied attributes (such as 'organizer id', 'width', 'height', 'transparency', 'header', 'border', and 'layout') in the org event scode() function. The attribute values are concatenated directly into HTML attributes without esc attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[lvca carousel]` and `[lvca posts carousel]` shortcode attributes in all versions up to, and including, 3.9.4 due to insufficient input sanitization and output escaping. Specifically, shortcode attributes are encoded with `wp json encode()` and output into single-quoted `data-settings` HTML attributes without using `esc attr()`, allowing attackers to break out of the attribute by injecting single quotes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Animate Your Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animation-set' shortcode in versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes in the shortcode args to html attrs() function, which concatenates shortcode attribute values directly into double-quoted HTML attributes without calling esc attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Formidable Kinetic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'kinetic link' shortcode in versions up to, and including, 1.1.01. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes (notably 'window', 'class', and 'label') in the FrmKinetic::link() function, which are concatenated directly into HTML attributes of an anchor tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The iWR Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `iwrtooltip` shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes in the iwr tooltip() shortcode handler — the `title` attribute is concatenated directly into an HTML attribute without esc attr() or any other escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Content Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.