Dj

**Name of the Vulnerable Software and Affected Versions** CM Business Directory versions prior to 1.5.8 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs when arbitrary web scripts are injected into pages via business address meta fields, which then execute when a user accesses the affected page. Because the payload is stored in post meta instead of post content, the WordPress `unfiltered html` capability restriction is bypassed. The affected variables include `cmbd address`, `cmbd cityTown`, `cmbd stateCounty`, `cmbd postalcode`, `cmbd region`, and `cmbd country`. **Recommendations** Update to a version newer than 1.5.7. Restrict the use of the `cmbd address`, `cmbd cityTown`, `cmbd stateCounty`, `cmbd postalcode`, `cmbd region`, and `cmbd country` fields to trusted users only.

**Name of the Vulnerable Software and Affected Versions** WP Photo Album Plus versions prior to 9.1.13.006 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. An attacker can inject arbitrary web scripts into pages by embedding a malicious `[photo]` shortcode in a post submitted for review. These scripts execute when an administrator or any other user views the affected page. The issue is triggered via the `subtext` parameter. **Recommendations** Update WP Photo Album Plus to version 9.1.13.006 or later.

**Name of the Vulnerable Software and Affected Versions** FV Flowplayer Video Player versions prior to 7.5.51.722 **Description** Stored Cross-Site Scripting (XSS) occurs due to insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `align` attribute of the `video player` shortcode. These scripts execute whenever a user visits the affected page. **Recommendations** Update to a version newer than 7.5.51.7212. As a temporary mitigation, restrict the ability of users with contributor-level access to edit pages or use the `video player` shortcode.

**Name of the Vulnerable Software and Affected Versions** Event Organiser versions prior to 3.13.0 **Description** The Event Organiser plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `eo events` shortcode accepts attacker-controlled `no events` content and renders it in event list templates without proper output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update the plugin to a version later than 3.12.9.

**Name of the Vulnerable Software and Affected Versions** Featured Image versions prior to 2.2 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update to a version newer than 2.1.

**Name of the Vulnerable Software and Affected Versions** Canvas plugin for WordPress versions prior to 2.5.3 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts via the `tag` parameter. These scripts execute whenever a user accesses the affected page. **Recommendations** Update the plugin to a version later than 2.5.2. As a temporary workaround, restrict access to the `tag` parameter for users with contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** ZeM STL plugin for WordPress versions prior to 1.1 **Description** Stored Cross-Site Scripting is possible via the `[zemstl]` shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. Specifically, the `url`, `color`, and `bgcolor` parameters are interpolated into HTML attribute contexts without being processed by `esc attr()` or similar escaping functions. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update the plugin to a version later than 1.0. As a temporary mitigation, restrict the ability of users with Contributor-level access to use the `[zemstl]` shortcode or modify the `url`, `color`, and `bgcolor` parameters.

**Name of the Vulnerable Software and Affected Versions** Simple Divi Shortcode versions prior to 1.3 **Description** The Simple Divi Shortcode plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `showmodule shortcode()` function fails to properly sanitize input and escape output when handling the `id` parameter of the `[showmodule]` shortcode. The `id` attribute is concatenated directly into a dynamically constructed shortcode string without using `esc attr()` or other escaping methods, allowing an attacker to break the attribute context and inject arbitrary HTML. Authenticated attackers with contributor-level access or higher can inject malicious web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update to a version later than 1.2. As a temporary workaround, restrict the use of the `id` parameter within the `[showmodule]` shortcode or limit user permissions to prevent contributors from editing pages with this shortcode.

**Name of the Vulnerable Software and Affected Versions** Shariff Wrapper versions prior to 4.6.21 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. The issue exists within the `headline` parameter of the `[shariff]` shortcode. It occurs because the plugin utilizes a custom `wp kses` implementation with permissive HTML tags and subsequently performs a `str replace` operation that injects HTML after sanitization. This sequence allows the introduction of event handlers through the `%total` placeholder in the style attribute, enabling the execution of arbitrary web scripts when a user visits an affected page. **Recommendations** Update Shariff Wrapper to version 4.6.21 or later. Avoid using the `headline` parameter in the `[shariff]` shortcode until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Query Shortcode versions prior to 0.2.2 **Description** The Query Shortcode plugin for WordPress contains a Local File Inclusion issue within the shortcode function. Authenticated attackers with contributor-level access or higher can exploit this by using the `lens` shortcode attribute to include and execute arbitrary .php files on the server. This allows for the execution of PHP code, which can be used to bypass access controls or obtain sensitive data, particularly when .php files can be uploaded to the server. **Recommendations** Update the plugin to a version later than 0.2.1.

**Name of the Vulnerable Software and Affected Versions** Single Mailchimp plugin for WordPress versions prior to 1.5 **Description** Stored Cross-Site Scripting occurs via the 'single-mailchimp' shortcode. The issue stems from insufficient input sanitization and output escaping of user-supplied shortcode attributes `autocomplete`, `label`, `placeholder`, `btn text`, `success msg`, and `error msg`, which are concatenated directly into HTML output by the `single mailchimp()` function in shortcodes.php. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** Update the plugin to a version later than 1.4. As a temporary mitigation, restrict contributor-level access to editing pages containing the 'single-mailchimp' shortcode.

**Name of the Vulnerable Software and Affected Versions** Post Category Gallery versions prior to 1.0.1 **Description** Stored Cross-Site Scripting occurs via the 'postcategorygallery' shortcode. The issue stems from insufficient input sanitization and output escaping within the `sc horcatbar()` function. Specifically, user-supplied shortcode attributes such as `total width`, `color scheme`, and `caption font size` are concatenated directly into HTML attribute values. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update to a version later than 1.0.0. As a temporary mitigation, restrict the use of the `postcategorygallery` shortcode and its attributes `total width`, `color scheme`, and `caption font size` for users with contributor-level access.

**Name of the Vulnerable Software and Affected Versions** Geo Mashup versions prior to 1.13.18 **Description** Improper neutralization of input during web page generation allows for stored Cross-site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server and then served to other users. **Recommendations** Update to a version newer than 1.13.18.

**Name of the Vulnerable Software and Affected Versions** jQuery googleslides plugin for WordPress versions prior to 1.4 **Description** Stored Cross-Site Scripting occurs via the 'googleslides' shortcode. The issue stems from insufficient input sanitization and output escaping within the `googleslides handler()` function. Specifically, the function interpolates user-supplied attributes—`userid`, `albumid`, `authkey`, `imgmax`, `maxresults`, `random`, `caption`, `albumlink`, `time`, and `fadespeed`—directly into single-quoted HTML attributes without utilizing `esc attr()`. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update the jQuery googleslides plugin for WordPress to version 1.4 or later.

**Name of the Vulnerable Software and Affected Versions** Livemesh Addons for Beaver Builder versions prior to 3.9.3 **Description** Stored Cross-Site Scripting occurs via the `labb admin ajax` AJAX action due to missing authorization checks and insufficient input sanitization. While the AJAX handler verifies a nonce, it fails to check user capabilities. This allows authenticated attackers with Subscriber-level access or higher to modify plugin settings and inject malicious scripts. These scripts execute when administrators access the plugin settings page or when any user visits the frontend. **Recommendations** Update Livemesh Addons for Beaver Builder to version 3.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** Events In City versions prior to 3.1 **Description** Stored Cross-Site Scripting occurs via the 'org-events' shortcode. The issue stems from insufficient input sanitization and output escaping within the `org event scode()` function. Specifically, user-supplied attributes including `organizer id`, `width`, `height`, `transparency`, `header`, `border`, and `layout` are concatenated directly into HTML attributes without using `esc attr()`. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update to a version later than 3.0. As a temporary mitigation, restrict the ability of users with contributor-level access to edit pages or use the 'org-events' shortcode.

**Name of the Vulnerable Software and Affected Versions** WPBakery Page Builder Addons by Livemesh versions prior to 3.9.5 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Shortcode attributes for `[lvca carousel]` and `[lvca posts carousel]` are encoded using `wp json encode()` and placed into single-quoted `data-settings` HTML attributes without the use of `esc attr()`. This allows authenticated attackers with Contributor-level access or higher to inject single quotes to break out of the attribute and execute arbitrary web scripts when a user visits the affected page. **Recommendations** Update to a version newer than 3.9.4.

**Name of the Vulnerable Software and Affected Versions** Animate Your Content versions prior to 1.0.1 **Description** Stored Cross-Site Scripting occurs via the 'animation-set' shortcode. The issue stems from insufficient input sanitization and output escaping within the `shortcode args to html attrs()` function, which concatenates attribute values directly into HTML attributes without using `esc attr()`. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** Update Animate Your Content to version 1.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** iWR Tooltip versions prior to 1.1 **Description** The plugin contains a Stored Cross-Site Scripting issue within the `iwrtooltip` shortcode. The `iwr tooltip()` function fails to properly sanitize input and escape output for user-supplied attributes. Specifically, the `title` attribute is concatenated directly into an HTML attribute without using `esc attr()` or other escaping methods. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update the plugin to a version later than 1.0. As a temporary mitigation, restrict the ability of users with contributor-level access to edit pages or use the `iwrtooltip` shortcode.

**Name of the Vulnerable Software and Affected Versions** Formidable Kinetic versions prior to 1.1.02 **Description** Stored Cross-Site Scripting occurs via the `kinetic link` shortcode. The issue stems from insufficient input sanitization and output escaping within the `FrmKinetic::link()` function. Specifically, user-supplied shortcode attributes `window`, `class`, and `label` are concatenated directly into HTML attributes of an anchor tag. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update to a version newer than 1.1.01. As a temporary mitigation, restrict the use of the `kinetic link` shortcode or limit user permissions to prevent contributors from editing pages.