Nail Majdeddine

**Name of the Vulnerable Software and Affected Versions** Extra Settings for RocketChat versions prior to 0.2 **Description** The Extra Settings for RocketChat plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `rxstg shortcode()` function fails to properly sanitize input and escape output when processing the `title` attribute of the 'rocketchat' shortcode, concatenating it directly into the HTML output. Authenticated attackers with contributor-level access or higher can exploit this to inject arbitrary web scripts into pages, which then execute when accessed by other users. **Recommendations** Update the plugin to a version later than 0.1. As a temporary workaround, restrict the use of the `title` attribute within the 'rocketchat' shortcode for users with contributor-level access.

**Name of the Vulnerable Software and Affected Versions** Cryptocurrency Prijsvergelijking Widget version 1.0 **Description** Stored Cross-Site Scripting occurs due to insufficient output escaping in the `as get coin shortcode()` function. The plugin renders the `width` and `height` shortcode attributes directly into the style attribute of an <iframe> element without using escaping functions like `esc attr()`. Authenticated attackers with contributor-level access or higher can provide a crafted value to terminate the style attribute and inject arbitrary HTML attributes, allowing the execution of malicious web scripts when a user visits the affected page. **Recommendations** Update Cryptocurrency Prijsvergelijking Widget to a version newer than 1.0. As a temporary mitigation, restrict user permissions to prevent users with contributor-level access from editing pages or posts.

**Name of the Vulnerable Software and Affected Versions** GNTT Post Title Ticker version 1.0 **Description** Stored Cross-Site Scripting occurs via the `title-ticker-slide`, `title-ticker-fade`, and `title-ticker-typing` shortcodes. The issue stems from insufficient input sanitization and output escaping of shortcode attributes, specifically `border`, `width`, `height`, `header background`, `header text color`, and `id`, within the `gntt title ticker slide()`, `gntt title ticker fade()`, and `gntt title ticker typing()` functions. Because these attribute values are not processed through `esc attr()` or similar escaping functions before being concatenated into HTML output, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GBI To Print version 1.0 **Description** Stored Cross-Site Scripting occurs when authenticated attackers with contributor-level access or higher inject arbitrary web scripts into pages. The issue stems from insufficient output escaping in the `gbi toprint shortcode()` function, which concatenates the raw value of the `div` attribute within the `gbitoprint` shortcode directly into an HTML attribute without using `esc attr()` or other sanitization methods. **Recommendations** Update GBI To Print to a version newer than 1.0. As a temporary mitigation, restrict the ability of users with contributor-level access to edit pages or use the `gbitoprint` shortcode.

**Name of the Vulnerable Software and Affected Versions** Endless Scroll versions prior to 1.0.1 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within shortcode attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update to a version newer than 1.0.0.

**Name of the Vulnerable Software and Affected Versions** Google+ Link Name plugin for WordPress versions prior to 1.1 **Description** Stored Cross-Site Scripting occurs via the `gplusnamelink` shortcode. The issue stems from insufficient input sanitization and output escaping within the `gplusnamelink generate()` function. Specifically, the `id` and `name` variables are concatenated directly into the rendered HTML without using `esc attr()` or `esc html()`. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update the plugin to a version later than 1.0. As a temporary mitigation, restrict user permissions to prevent users with contributor-level access from editing pages or using the `gplusnamelink` shortcode.

**Name of the Vulnerable Software and Affected Versions** Responsive Check versions prior to 0.0.4 **Description** Stored Cross-Site Scripting occurs via the 'rspcheck' shortcode. The issue stems from insufficient input sanitization and output escaping within the `rspc check shortcode()` function. Specifically, the `url` and `button` shortcode attributes are echoed directly into iframe src attributes without using `esc attr()` or `esc url()`. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update to a version newer than 0.0.3. As a temporary mitigation, restrict the use of the 'rspcheck' shortcode or limit user permissions to prevent contributors from editing pages.

**Name of the Vulnerable Software and Affected Versions** Islamic Database plugin for WordPress version 1.0 **Description** Stored Cross-Site Scripting occurs via the 'islamicDB-roqya' shortcode. The issue stems from insufficient input sanitization and output escaping of the `width` and `height` shortcode attributes within the `islamicDB sc quran qari roqya()` function, which are concatenated directly into HTML iframe attribute values. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tuxquote versions prior to 1.4 **Description** The Tuxquote plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `tuxquote build format()` function fails to properly sanitize and escape user-supplied attributes `title`, `align`, and `width` used within the 'TUXQUOTE' shortcode. These attributes are concatenated directly into the rendered HTML without being processed by `esc attr()` or `esc html()`. Consequently, authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update the plugin to a version later than 1.3. As a temporary mitigation, restrict the ability of users with Contributor-level access to use the 'TUXQUOTE' shortcode.

**Name of the Vulnerable Software and Affected Versions** Dideo plugin for WordPress version 1.0 **Description** Stored Cross-Site Scripting occurs via the `dideo` shortcode. The issue stems from insufficient input sanitization and output escaping of the `id` shortcode attribute, which is interpolated directly into an HTML iframe `src` attribute within the `dideo()` shortcode handler. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** As a temporary workaround, restrict the use of the `id` attribute within the `dideo` shortcode or limit user permissions to prevent contributors from editing pages until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Voyage Plus versions prior to 1.0.7 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts via the `class` attribute of the `post-content` shortcode. These scripts execute whenever a user accesses the affected page. **Recommendations** Update Voyage Plus to version 1.0.7 or later. As a temporary mitigation, restrict the use of the `class` attribute within the `post-content` shortcode for users with contributor-level access.

**Name of the Vulnerable Software and Affected Versions** Credits Shortcode versions prior to 1.3 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages via the `link` attribute of the `credits` shortcode. These scripts execute whenever a user accesses the affected page. **Recommendations** Update the plugin to a version later than 1.2. As a temporary mitigation, restrict the ability of users with contributor-level access to edit pages containing the `credits` shortcode.

**Name of the Vulnerable Software and Affected Versions** scratchblocks for WP versions prior to 1.0.2 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages via the `element` attribute of the `scratchblocks` shortcode. These scripts execute whenever a user accesses the affected page. **Recommendations** Update scratchblocks for WP to version 1.0.2 or later. As a temporary mitigation, restrict the use of the `element` attribute within the `scratchblocks` shortcode for users with contributor-level access.

**Name of the Vulnerable Software and Affected Versions** Quick Table versions prior to 1.0.1 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts via the `style` attribute of the `qtbl` shortcode. These scripts execute whenever a user accesses the affected page. **Recommendations** Update to a version newer than 1.0.0. As a temporary workaround, restrict the use of the `style` attribute within the `qtbl` shortcode.

**Name of the Vulnerable Software and Affected Versions** Simple Owl Shortcodes versions prior to 2.1.2 **Description** The Simple Owl Shortcodes plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping of user-supplied attributes within the 'owls wrapper' shortcode, specifically affecting the `num` attribute. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update to a version later than 2.1.1. As a temporary workaround, restrict the use of the `num` attribute in the 'owls wrapper' shortcode.

**Name of the Vulnerable Software and Affected Versions** Simple Random Posts Shortcode versions prior to 0.4 **Description** The Simple Random Posts Shortcode plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. This occurs because the plugin fails to properly sanitize input and escape output for the `container right width` attribute within the 'simple random posts' shortcode. These scripts execute whenever a user visits the affected page. **Recommendations** Update the plugin to a version newer than 0.3. As a temporary workaround, restrict the use of the `container right width` attribute in the 'simple random posts' shortcode.

**Name of the Vulnerable Software and Affected Versions** Posts map plugin for WordPress versions prior to 0.1.4 **Description** Insufficient input sanitization and output escaping on user supplied attributes allow authenticated attackers with contributor-level access and above to inject arbitrary web scripts. This occurs via the 'name' shortcode attribute, resulting in scripts that execute whenever a user accesses an injected page. Stored Cross-Site Scripting is a flaw where a malicious script is permanently stored on the target server. **Recommendations** Update the plugin to a version later than 0.1.3.

**Name of the Vulnerable Software and Affected Versions** SlideShowPro SC versions prior to 1.0.3 **Description** The SlideShowPro SC plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping on user supplied attributes within the `slideShowProSC` shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update the plugin to a version later than 1.0.2.

**Name of the Vulnerable Software and Affected Versions** Text Snippets versions prior to 0.0.2 **Description** The Text Snippets plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping on user supplied attributes within the `ts` shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page. **Recommendations** Update to a version later than 0.0.1.

**Name of the Vulnerable Software and Affected Versions** VI: Include Post By versions prior to 0.4.200706 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts via the `class container` attribute of the 'include-post-by-cat' shortcode. These scripts execute whenever a user accesses an affected page. **Recommendations** Update to a version later than 0.4.200706.