Easy Social Feed – Social Photos Gallery – Post Feed – Like Box by Malta Themes

Easy Social Feed – Social Photos Gallery – Post Feed – Like Box by Malta Themes <= 6.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (XSS) via Shortcode

REPORT ID: fc6ce2a4-fecb-479b-9b8a-5031eee19faa

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.

References

Source Code: https://wordpress.org/plugins/easy-facebook-likebox/

CVE: CVE-2022-4474

Attributes

Catgory: WordPress Plugin

Vulnerability Discovered: 2022-12-13

Report Published: 2022-12-27

Affected Version: <= 6.3.9

Classification

Type: Cross-Site Scripting (XSS)

Researcher

Name: István Márton

Email: [email protected]

Support Us?

We would truly appreciate it if you bought us a bunny (food for a snow leopard).