Gilang

**Name of the Vulnerable Software and Affected Versions** ZeM STL plugin for WordPress versions prior to 1.1 **Description** Stored Cross-Site Scripting is possible via the `[zemstl]` shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. Specifically, the `url`, `color`, and `bgcolor` parameters are interpolated into HTML attribute contexts without being processed by `esc attr()` or similar escaping functions. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update the plugin to a version later than 1.0. As a temporary mitigation, restrict the ability of users with Contributor-level access to use the `[zemstl]` shortcode or modify the `url`, `color`, and `bgcolor` parameters.

**Name of the Vulnerable Software and Affected Versions** Events In City versions prior to 3.1 **Description** Stored Cross-Site Scripting occurs via the 'org-events' shortcode. The issue stems from insufficient input sanitization and output escaping within the `org event scode()` function. Specifically, user-supplied attributes including `organizer id`, `width`, `height`, `transparency`, `header`, `border`, and `layout` are concatenated directly into HTML attributes without using `esc attr()`. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update to a version later than 3.0. As a temporary mitigation, restrict the ability of users with contributor-level access to edit pages or use the 'org-events' shortcode.

**Name of the Vulnerable Software and Affected Versions** jQuery googleslides plugin for WordPress versions prior to 1.4 **Description** Stored Cross-Site Scripting occurs via the 'googleslides' shortcode. The issue stems from insufficient input sanitization and output escaping within the `googleslides handler()` function. Specifically, the function interpolates user-supplied attributes—`userid`, `albumid`, `authkey`, `imgmax`, `maxresults`, `random`, `caption`, `albumlink`, `time`, and `fadespeed`—directly into single-quoted HTML attributes without utilizing `esc attr()`. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update the jQuery googleslides plugin for WordPress to version 1.4 or later.

**Name of the Vulnerable Software and Affected Versions** Post Category Gallery versions prior to 1.0.1 **Description** Stored Cross-Site Scripting occurs via the 'postcategorygallery' shortcode. The issue stems from insufficient input sanitization and output escaping within the `sc horcatbar()` function. Specifically, user-supplied shortcode attributes such as `total width`, `color scheme`, and `caption font size` are concatenated directly into HTML attribute values. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update to a version later than 1.0.0. As a temporary mitigation, restrict the use of the `postcategorygallery` shortcode and its attributes `total width`, `color scheme`, and `caption font size` for users with contributor-level access.

**Name of the Vulnerable Software and Affected Versions** Single Mailchimp plugin for WordPress versions prior to 1.5 **Description** Stored Cross-Site Scripting occurs via the 'single-mailchimp' shortcode. The issue stems from insufficient input sanitization and output escaping of user-supplied shortcode attributes `autocomplete`, `label`, `placeholder`, `btn text`, `success msg`, and `error msg`, which are concatenated directly into HTML output by the `single mailchimp()` function in shortcodes.php. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** Update the plugin to a version later than 1.4. As a temporary mitigation, restrict contributor-level access to editing pages containing the 'single-mailchimp' shortcode.

**Name of the Vulnerable Software and Affected Versions** Animate Your Content versions prior to 1.0.1 **Description** Stored Cross-Site Scripting occurs via the 'animation-set' shortcode. The issue stems from insufficient input sanitization and output escaping within the `shortcode args to html attrs()` function, which concatenates attribute values directly into HTML attributes without using `esc attr()`. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** Update Animate Your Content to version 1.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Responsive Video Embedder versions prior to 0.2 **Description** Stored Cross-Site Scripting occurs via the 'rem video' shortcode. The issue stems from insufficient input sanitization and output escaping in the `video shortcode()` function. Specifically, user-supplied attributes `id` and `list` are concatenated directly into an HTML iframe's src attribute without escaping. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update Responsive Video Embedder to a version newer than 0.1. As a temporary mitigation, restrict the use of the 'rem video' shortcode or limit user permissions to prevent contributors from editing pages.

**Name of the Vulnerable Software and Affected Versions** Content Slideshow versions prior to 2.4.2 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within shortcode attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update the plugin to version 2.4.2 or later.

**Name of the Vulnerable Software and Affected Versions** QuestionPro Surveys plugin for WordPress versions prior to 1.1 **Description** The QuestionPro Surveys plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'questionpro' shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update the QuestionPro Surveys plugin to version 1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Sphere Manager plugin for WordPress versions up to and including 1.0.2 **Description** The software is susceptible to Stored Cross-Site Scripting through the `width` parameter within the 'show sphere image' shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the Sphere Manager plugin to a version beyond 1.0.2.

**Name of the Vulnerable Software and Affected Versions** Simple Wp colorfull Accordion plugin for WordPress versions prior to 1.0 **Description** The Simple Wp colorfull Accordion plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `title` parameter within the 'accordion' shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. These scripts will execute whenever a user accesses the compromised page. **Recommendations** Update the Simple Wp colorfull Accordion plugin to a version newer than 1.0.

**Name of the Vulnerable Software and Affected Versions** Percent to Infograph plugin for WordPress versions prior to 1.1 **Description** The Percent to Infograph plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `percent to graph` shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. The `percent to graph` shortcode is the specific component affected. **Recommendations** Update to version 1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Citations tools plugin for WordPress versions up to and including 0.3.2 **Description** The Citations tools plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping on user-supplied attributes within the 'code' parameter of the 'ctdoi' shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the Citations tools plugin to a version newer than 0.3.2.

**Name of the Vulnerable Software and Affected Versions** Simple Plyr plugin for WordPress versions prior to 0.0.2 **Description** The Simple Plyr plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `poster` parameter within the 'plyr' shortcode. Insufficient input sanitization and output escaping of user-supplied attributes allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses the affected page. **Recommendations** Update the Simple Plyr plugin to version 0.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Docus – YouTube Video Playlist plugin for WordPress versions through 1.0.6 **Description** The Docus – YouTube Video Playlist plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `docusplaylist` shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the Docus – YouTube Video Playlist plugin to a version newer than 1.0.6.

**Name of the Vulnerable Software and Affected Versions** WordPress Live Webcam Widget & Shortcode plugin versions prior to 1.3 **Description** The WordPress Live Webcam Widget & Shortcode plugin is susceptible to Stored Cross-Site Scripting through the 'webcam' shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the WordPress Live Webcam Widget & Shortcode plugin to version 1.3 or later.

**Name of the Vulnerable Software and Affected Versions** A Simple Multilanguage Plugin versions prior to 1.0 **Description** The A Simple Multilanguage Plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'asmp-switcher' shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update A Simple Multilanguage Plugin to a version newer than 1.0.

**Name of the Vulnerable Software and Affected Versions** Fintelligence Calculator plugin for WordPress versions up to and including 1.0.3 **Description** The Fintelligence Calculator plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'fintelligence-calculator' shortcode. This is due to inadequate input sanitization and output escaping of user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the Fintelligence Calculator plugin to a version beyond 1.0.3.

**Name of the Vulnerable Software and Affected Versions** Event Tickets, RSVPs, Calendar versions up to and including 1.0.2 **Description** The Event Tickets, RSVPs, Calendar plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'ticket spot' shortcode. This is due to inadequate input sanitization and output escaping of user-provided attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update Event Tickets, RSVPs, Calendar to a version newer than 1.0.2.

**Name of the Vulnerable Software and Affected Versions** Auto Bulb Finder for WordPress plugin versions prior to 2.8.1 **Description** The Auto Bulb Finder for WordPress plugin is susceptible to Stored Cross-Site Scripting through the 'abf vehicle' shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. **Recommendations** Update the Auto Bulb Finder for WordPress plugin to version 2.8.1 or later.