Zaim

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts via the 'button' attribute of the `logout-url` shortcode. These scripts execute whenever a user accesses the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes within the `bold timeline item` shortcode. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts via the `supertitle` and `subtitle` attributes. These scripts execute whenever a user accesses the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts via the `posttype` attribute of the `SimpleYearlyArchive` shortcode. These scripts execute whenever a user accesses the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of the `chart size` attribute within the `skillwrapper` shortcode. The attribute is concatenated directly into an inline `<style>` block, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute whenever a user visits the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts through the `text` attribute of the `wpcbm best seller` shortcode. These scripts execute whenever a user accesses the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on the `type` attribute of the `customer-area-protected-content` shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes within the `freshpodcaster` shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of the description attribute within the `render body()` method of the `Image Box View` class. While other attributes are processed using `esc attr()`, the value of the `sg body description` parameter in the Image Box widget is concatenated directly into the HTML body context. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping in the `bookero products()` function. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts via the `hide products` and `filter products` attributes of the `bookero products` shortcode. These scripts are concatenated directly into an inline `<script>` block and execute when a user accesses the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes within the `seedprodnestedmenuwidget` shortcode. This allows authenticated attackers with contributor level access and above to inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

Cross Site Scripting (XSS) allows an attacker with contributor privileges to execute malicious scripts in the browser of other users.

Cross Site Scripting (XSS) allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. XSS is a security flaw where an application includes untrusted data in a web page without proper validation or escaping.

A Cross Site Scripting (XSS) issue exists that allows users with Contributor privileges to execute malicious scripts. XSS is a type of security flaw where an attacker injects scripts into web pages viewed by other users.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping in the `FilterCourseTemplate::sections()` function. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts through the `class wrapper form` attribute of the `class wrapper form` shortcode. The issue arises because the `FilterCourseShortcode::render()` handler fails to apply `shortcode atts()` filtering, allowing raw user attributes to be inserted into an HTML class attribute via `sprintf()` without proper `esc attr()` escaping. These scripts execute whenever a user visits the affected page.

The software contains a flaw related to improper handling of user-supplied data during web page creation, which can lead to a DOM-based cross-site scripting (XSS) issue. This allows an attacker to inject malicious scripts into web pages viewed by other users. The issue affects the `profit-products-tables-for-woocommerce` component.

The software contains a flaw related to improper input neutralization during web page generation, leading to a DOM-based cross-site scripting issue. This allows for the execution of malicious scripts within the user's browser.

The software contains a flaw due to improper neutralization of input during web page generation, leading to a Stored Cross-site Scripting (XSS) issue. This allows for the injection of malicious scripts into web pages. The vulnerability exists in the `themify-event-post` component. The issue allows for Stored XSS, meaning the malicious script is persistently stored on the target server.

The software is susceptible to a cross-site scripting issue due to improper input validation during web page generation. This allows for the injection of malicious scripts, specifically Stored XSS. The issue affects the Podlove Podcast Publisher WordPress plugin.

The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a potential Cross-site Scripting (XSS) issue. This specific instance allows for Stored XSS, meaning malicious scripts can be stored and executed by other users. The vulnerability exists because the application does not adequately sanitize input, potentially allowing attackers to inject malicious code into web pages viewed by other users.

The software contains a flaw due to improper neutralization of input during web page generation, leading to a Stored Cross-site Scripting (XSS) condition. This allows for the injection of malicious scripts into web pages viewed by other users. The vulnerability affects the MediaPress plugin. No information was provided regarding the number of potentially affected devices or any real-world incidents where this issue was exploited. The vulnerability allows for Stored XSS, meaning that malicious scripts are permanently stored on the target server.