Tien Luong

**Name of the Vulnerable Software and Affected Versions** Knight Lab Timeline plugin for WordPress versions up to, and including, 3.9.3.3 **Description** The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcode(s). This allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages, which will execute whenever a user accesses an injected page. **Recommendations** For Knight Lab Timeline plugin for WordPress versions up to, and including, 3.9.3.3, update to a version that addresses the insufficient input sanitization and output escaping issue. As a temporary workaround, consider restricting access to the plugin's shortcode(s) to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Easy Textillate plugin for WordPress versions up to, and including, 2.01 **Description** The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's `textillate` shortcode. This allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages. The injected scripts will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 2.01, update to a version that addresses the insufficient input sanitization and output escaping issue in the `textillate` shortcode. As a temporary workaround, consider restricting access to the `textillate` shortcode for users with contributor-level and above permissions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Animated Headline plugin for WordPress versions up to, and including, 4.0 **Description** The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'animated-headline' shortcode. This allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages, which will execute whenever a user accesses an injected page. **Recommendations** For Animated Headline plugin for WordPress versions up to, and including, 4.0, update to a version that addresses the insufficient input sanitization and output escaping issue. As a temporary workaround, consider restricting access to the 'animated-headline' shortcode for users with contributor-level and above permissions until a patch is available.