SiteOrigin Widgets Bundle < 1.58.4 - Contributor+ Stored Cross-Site Scripting

2024-02-1200:00:00

wpscan.com

siteorigin widgets

stored cross-site scripting

input sanitization

output escaping

authenticated attackers

AI Score

5.5

Confidence

High

EPSS

Percentile

15.5%

JSON

Description The plugin is vulnerable to Stored Cross-Site Scripting via the code editor due to insufficient input sanitization and output escaping, allowing authenticated attackers, with contributor access or higher, to perform Stored XSS attacks

References

www.wordfence.com/threat-intel/vulnerabilities/id/ffeb766f-3684-4eec-bacb-bbf0d434aba0