WP-WebAuthn <=1.3.1 Authenticated Stored XSS via wwa_login_form Shortcode

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: WP-WebAuthn <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wwa_login_form Shortcode 2. Vulnerability Type: Cross-site Scripting (XSS) 3. Affected Scope: Plugin/Theme versions <= 1.3.1 4. Severity Level: Medium (6.4) 5. Disclosure Date: September 27, 2024 6. Update Date: September 28, 2024 7. Researcher: Peter Thaleikis 8. Vulnerability Description: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 9. Reference Links: wordpress.org, plugins.trac.wordpress.org 10. Fix Status: No known fix available. 11. Affected Versions: <= 1.3.1 12. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 13. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 14. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 15. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 16. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 17. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 18. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 19. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 20. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 21. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 22. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 23. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 24. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 25. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 26. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 27. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 28. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 29. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 30. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 31. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 32. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 33. Exploitation: The plugin's shortcode has insufficient input validation and output escaping issues, allowing attackers to inject arbitrary scripts when users access the injected page. 34. Exploitation: The plugin's shortcode has insufficient input validation and outp

Goal Reached Thanks to every supporter — we hit 100%!

WP-WebAuthn <=1.3.1 Authenticated Stored XSS via wwa_login_form Shortcode

More from this source