PT-2026-45708 · WordPress · Zem Stl
CVSS v3.1
6.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
ZeM STL plugin for WordPress versions prior to 1.1
Description
Stored Cross-Site Scripting is possible via the
[zemstl] shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. Specifically, the url, color, and bgcolor parameters are interpolated into HTML attribute contexts without being processed by esc attr() or similar escaping functions. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page.Recommendations
Update the plugin to a version later than 1.0.
As a temporary mitigation, restrict the ability of users with Contributor-level access to use the
[zemstl] shortcode or modify the url, color, and bgcolor parameters.Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Zem Stl