Lucene search
Apple502jWPEX-ID:9C538C51-AE58-461D-B93B-CC9DFEBF2BC0HistoryJun 21, 2021 - 12:00 a.m.
Browser Screenshots < 1.7.6 - Contributor+ Stored XSS
2021-06-2100:00:00
apple502j
293
browser screenshots
stored xss
shortcode
page view
exploit
contributor+
EPSS
0.001
Percentile
24.8%
The plugin allowed authenticated users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks as the image_class parameter of the browser-shot shortcode was not escaped.
Add the following shortcode in a page, then view the page (either published or as preview to trigger the XSS): [browser-shot url="https://example.com" image_class='" onload="alert(origin)']Related
patchstack
patchstack
wpvulndb
wpvulndb
Browser Screenshots < 1.7.6 - Contributor+ Stored XSS
2021-06-21 00:00:00
cve
cve
CVE-2021-24439
2021-07-12 20:15:09
cnvd
cnvd
WordPress Plugin Code Injection Vulnerability (CNVD-2021-59600)
2021-07-14 00:00:00
cvelist
cvelist
CVE-2021-24439 Browser Screenshots < 1.7.6 - Contributor+ Stored XSS
2021-07-12 19:21:01
nvd
nvd
CVE-2021-24439
2021-07-12 20:15:09
prion
prion
Cross site scripting
2021-07-12 20:15:00