Gilang

**Name of the Vulnerable Software and Affected Versions** ZeM STL plugin for WordPress versions prior to 1.1 **Description** Stored Cross-Site Scripting is possible via the `[zemstl]` shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. Specifically, the `url`, `color`, and `bgcolor` parameters are interpolated into HTML attribute contexts without being processed by `esc attr()` or similar escaping functions. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update the plugin to a version later than 1.0. As a temporary mitigation, restrict the ability of users with Contributor-level access to use the `[zemstl]` shortcode or modify the `url`, `color`, and `bgcolor` parameters.

The Responsive Video Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rem video' shortcode in versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes (notably 'id' and 'list') in the video shortcode() function, which are concatenated directly into an HTML iframe's src attribute without escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The jQuery googleslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'googleslides' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes (userid, albumid, authkey, imgmax, maxresults, random, caption, albumlink, time, and fadespeed) in the googleslides handler() function, which interpolates the attribute values directly into single-quoted HTML attributes without using esc attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Post Category Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'postcategorygallery' shortcode in versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes (such as total width, color scheme, and caption font size) inside the sc horcatbar() function, which are concatenated directly into HTML attribute values. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Single Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'single-mailchimp' shortcode in all versions up to, and including, 1.4. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes (autocomplete, label, placeholder, btn text, success msg, error msg) which are concatenated directly into HTML output by the single mailchimp() function in shortcodes.php. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Content Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Animate Your Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animation-set' shortcode in versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes in the shortcode args to html attrs() function, which concatenates shortcode attribute values directly into double-quoted HTML attributes without calling esc attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Events In City plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'org-events' shortcode in versions up to, and including, 3.0. This is due to insufficient input sanitization and output escaping on user supplied attributes (such as 'organizer id', 'width', 'height', 'transparency', 'header', 'border', and 'layout') in the org event scode() function. The attribute values are concatenated directly into HTML attributes without esc attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Name of the Vulnerable Software and Affected Versions** QuestionPro Surveys plugin for WordPress versions prior to 1.1 **Description** The QuestionPro Surveys plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'questionpro' shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update the QuestionPro Surveys plugin to version 1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Sphere Manager plugin for WordPress versions up to and including 1.0.2 **Description** The software is susceptible to Stored Cross-Site Scripting through the `width` parameter within the 'show sphere image' shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the Sphere Manager plugin to a version beyond 1.0.2.

**Name of the Vulnerable Software and Affected Versions** Simple Wp colorfull Accordion plugin for WordPress versions prior to 1.0 **Description** The Simple Wp colorfull Accordion plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `title` parameter within the 'accordion' shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. These scripts will execute whenever a user accesses the compromised page. **Recommendations** Update the Simple Wp colorfull Accordion plugin to a version newer than 1.0.

**Name of the Vulnerable Software and Affected Versions** Percent to Infograph plugin for WordPress versions prior to 1.1 **Description** The Percent to Infograph plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `percent to graph` shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. The `percent to graph` shortcode is the specific component affected. **Recommendations** Update to version 1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Citations tools plugin for WordPress versions up to and including 0.3.2 **Description** The Citations tools plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping on user-supplied attributes within the 'code' parameter of the 'ctdoi' shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the Citations tools plugin to a version newer than 0.3.2.

**Name of the Vulnerable Software and Affected Versions** Simple Plyr plugin for WordPress versions prior to 0.0.2 **Description** The Simple Plyr plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `poster` parameter within the 'plyr' shortcode. Insufficient input sanitization and output escaping of user-supplied attributes allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses the affected page. **Recommendations** Update the Simple Plyr plugin to version 0.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Docus – YouTube Video Playlist plugin for WordPress versions through 1.0.6 **Description** The Docus – YouTube Video Playlist plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `docusplaylist` shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the Docus – YouTube Video Playlist plugin to a version newer than 1.0.6.

**Name of the Vulnerable Software and Affected Versions** WordPress Live Webcam Widget & Shortcode plugin versions prior to 1.3 **Description** The WordPress Live Webcam Widget & Shortcode plugin is susceptible to Stored Cross-Site Scripting through the 'webcam' shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the WordPress Live Webcam Widget & Shortcode plugin to version 1.3 or later.

**Name of the Vulnerable Software and Affected Versions** A Simple Multilanguage Plugin versions prior to 1.0 **Description** The A Simple Multilanguage Plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'asmp-switcher' shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update A Simple Multilanguage Plugin to a version newer than 1.0.

**Name of the Vulnerable Software and Affected Versions** Fintelligence Calculator plugin for WordPress versions up to and including 1.0.3 **Description** The Fintelligence Calculator plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'fintelligence-calculator' shortcode. This is due to inadequate input sanitization and output escaping of user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the Fintelligence Calculator plugin to a version beyond 1.0.3.

**Name of the Vulnerable Software and Affected Versions** Event Tickets, RSVPs, Calendar versions up to and including 1.0.2 **Description** The Event Tickets, RSVPs, Calendar plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'ticket spot' shortcode. This is due to inadequate input sanitization and output escaping of user-provided attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update Event Tickets, RSVPs, Calendar to a version newer than 1.0.2.

**Name of the Vulnerable Software and Affected Versions** Auto Bulb Finder for WordPress plugin versions prior to 2.8.1 **Description** The Auto Bulb Finder for WordPress plugin is susceptible to Stored Cross-Site Scripting through the 'abf vehicle' shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the Auto Bulb Finder for WordPress plugin to version 2.8.1 or later.