Michał Lipiński

Lodash versions 4.0.0 through 4.17.22 are susceptible to prototype pollution within the ` .unset` and ` .omit` functions. An attacker can leverage crafted paths to trigger the deletion of methods from global prototypes. The issue allows for property deletion but does not permit modification of the original behavior of those properties.

The issue allows users with a role as low as contributor to set Cross-Site Scripting payload in the parameters from the shortcode, which will be triggered in the pages with the embed malicious shortcode.

The issue allows users with a role as low as contributor to set a Cross-Site Scripting payload in the parameters from the shortcode, which will be triggered in the pages with the embed malicious shortcode.

The issue allows users with a role as low as contributor to set Cross-Site Scripting payload in the parameters from the shortcode, which will be triggered in the pages with the embed malicious shortcode.

The issue allows users with a role as low as contributor to set Cross-Site Scripting payload in the parameters from its shortcode, which will be triggered in the pages with the embed malicious shortcode. This is due to the plugin not sanitising or validating the parameters from its shortcode.

The issue allows users with a role as low as contributor to set a Cross-Site Scripting payload in the parameters from its shortcode, which will be triggered in the page/s with the embed malicious shortcode.