Structured Content < 1.6 - Contributor+ Stored XSS

2023-12-0900:00:00

wpscan.com

structured content

stored xss

input sanitization

output escaping

authenticated attackers

contributor-level access

arbitrary web scripts

executable pages

vulnerable software

AI Score

5.7

Confidence

High

EPSS

Percentile

14.0%

JSON

Description The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References

patchstack.com/database/vulnerability/structured-content/wordpress-structured-content-json-ld-wpsc-plugin-1-5-3-cross-site-scripting-xss-vulnerability