Description (CNA)
The Uncode Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uncode_hl_text' and 'uncode_text_icon' shortcodes in all versions up to, and including, 2.9.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| undsgn / Uncode Core | affected 0 through 2.9.4.2 |
CWE
CWE-79
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/52935b60-3ec5-45e6-9d12-200bf107c9df?source=cve
- https://support.undsgn.com/hc/en-us/articles/213454129-Change-Log
ADP enrichment
No English description supplied.
No references supplied.