CVE-2024-2583

MEDIUM

5.4

Description

The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible for users with the contributor role to conduct Stored XSS attacks.

Details CVE

Score CVSS v3.15.4

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurREQUIRED

Publie4/13/2024

Derniere modification5/12/2025

Sourcenvd

Observations honeypot0

Produits affectes

getshortcodes:shortcodes_ultimate

Faiblesses (CWE)

CWE-79

References

https://wpscan.com/vulnerability/98d8c713-e8cd-4fad-a8fb-7a40db2742a2/(contact@wpscan.com)

https://wpscan.com/vulnerability/98d8c713-e8cd-4fad-a8fb-7a40db2742a2/(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.