Djaidja Moundjid

The plugin is susceptible to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. This occurs due to insufficient input sanitization and output escaping within the `before` and `after` attributes of the `the-subtitle` shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

The Sticky plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `cvmh sticky front render()` function fails to properly sanitize input and escape output for the `readmoretext` attribute within the `cvmh-sticky` shortcode. Specifically, the value of the `readmoretext` attribute is processed via `apply filters()` and concatenated into the HTML output without using escaping functions like `esc html()`. Consequently, authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits a page containing the malicious shortcode.

The Logo Manager For Enamad plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping on user-supplied attributes within the 'title' attribute of the `vc enamad namad`, `vc enamad shamed`, and `vc enamad custom` shortcodes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

The Bold Page Builder plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because of insufficient input sanitization and output escaping on user-supplied attributes, specifically within the `text` attribute of the 'bt bb button' shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping within the `permission message` parameter. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

The WPC Badge Management for WooCommerce plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping within the `text` attribute of the `wpcbm best seller` shortcode. Authenticated attackers with Shop Manager-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

The plugin is susceptible to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. This occurs due to insufficient input sanitization and output escaping of user-supplied attributes within the `default` shortcode attribute. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

The SP Blog Designer plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping within the 'design' attribute of the `wpsbd post carousel` shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Stored Cross-Site Scripting occurs via the `fancy-img-show` shortcode due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

The E2Pdf – Export Pdf Tool for WordPress plugin allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts. This occurs due to insufficient input sanitization and output escaping within the `id` attribute of the `e2pdf-download` shortcode. These scripts execute whenever a user accesses a page where the malicious code was injected.

Insufficient input sanitization and output escaping on user supplied attributes in the `strava nmr connect` shortcode allow authenticated attackers with contributor-level access and above to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the injected content. This is a Stored Cross-Site Scripting issue, where malicious scripts are permanently stored on the target server.

Stored Cross-Site Scripting occurs due to insufficient input sanitization of the `wrapper` attribute within the `[futureaction]` shortcode. The plugin utilizes the `esc html()` function, which encodes HTML entities but fails to prevent attribute injection when the value is used as an HTML tag name in a `sprintf()` call. This allows authenticated attackers with administrator-level access, or contributors if granted permission, to inject event handler attributes via spaces in the `wrapper` value. Consequently, arbitrary web scripts can be injected into pages and executed when a user accesses them.

The plugin is subject to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. This occurs due to insufficient input sanitization and output escaping within the `chartid` attribute of the shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

The Simple Link Directory plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. This occurs because the `qcopd-directory` shortcode does not sufficiently sanitize input or escape output for user-supplied attributes, specifically the `title font size` variable. These scripts execute whenever a user visits the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `text` attribute of the `wpcsm text rotator` shortcode. These scripts execute whenever a user visits the affected page.

The plugin is susceptible to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. The issue exists within the 'login link' shortcode due to inadequate input sanitization and output escaping of the `prefix` attribute. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

The CI HUB Connector plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. This occurs due to insufficient input sanitization and output escaping within the 'id' attribute of the `cihub metadata` shortcode. These scripts execute whenever a user visits the affected page.

Name of the Vulnerable Software and Affected Versions ShopLentor plugin for WordPress versions up to 3.3.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and missing output escaping on user-supplied shortcode attributes. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts via the `button text` attribute of the `woolentor quickview button` shortcode, which execute when a user accesses the affected page. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions up to and including 3.3.52 Description The Download Manager plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `sid` parameter of the 'wpdm members' shortcode. This occurs because of inadequate input sanitization and output escaping of the user-supplied `sid` shortcode attribute. The `sid` parameter is extracted without sanitization within the `members()` function and stored using `update post meta()`, then directly echoed into an HTML id attribute in the `members.php` template without `esc attr()`. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which will execute when a user accesses the affected page. Recommendations Download Manager plugin for WordPress version 3.3.53 and later Disable the 'wpdm members' shortcode if it is not required Sanitize and escape the `sid` parameter before using it in the 'wpdm members' shortcode

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions up to and including 5.3.0 Description The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `button caption` parameter within the [latepoint resources] shortcode. This occurs because of inadequate output escaping when the `items` parameter is set to 'bundles'. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which will then execute when a user accesses those pages. Recommendations Update LatePoint – Calendar Booking Plugin for Appointments and Events to a version later than 5.3.0.