Lucene search

K
wpvulndbWpvulndbWPVDB-ID:7C398F83-B0F3-431E-A5E7-2AADCF48D63A
HistoryMar 29, 2024 - 12:00 a.m.

Font Farsi <= 1.6.6 - Authenticated (Admin+) Stored Cross-Site Scripting

2024-03-2900:00:00
wpscan.com
7
wordpress
xss
vulnerability
input sanitization
output escaping
multi-site installations
unfiltered_html

AI Score

5.5

Confidence

High

EPSS

0

Percentile

9.0%

Description The Font Farsi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including 1.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AI Score

5.5

Confidence

High

EPSS

0

Percentile

9.0%

Related for WPVDB-ID:7C398F83-B0F3-431E-A5E7-2AADCF48D63A