WordPress Social Proof <=2.2.4 Authenticated Stored XSS via spslider-block Shortcode

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Social Proof (Testimonials) Slider <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via spslider-block Shortcode 2. Affected Software: Social Proof (Testimonials) Slider plugin 3. Vulnerability Type: Cross-site Scripting (XSS) 4. CVSS Score: 6.4 (Medium) 5. Public Release Date: November 12, 2024 6. Latest Update Date: November 13, 2024 7. Researcher: Peter Thaleikis 8. Vulnerability Description: The shortcode in the plugin has an unpatched XSS vulnerability across all versions, due to improper input handling and output escaping, allowing attackers to inject malicious scripts. 9. Reference Links: plugins.trac.wordpress.org, plugins.trac.wordpress.org, wordpress.org 10. Vulnerability Details: Includes software type, plugin name, whether a patch exists, and remediation advice. 11. Copyright and Licensing Information: Includes copyright and licensing details for Defiant Inc. and MITRE Corporation. 12. Vulnerability Scope: Affects plugin versions <= 2.2.4. 13. Exploitation: Attackers can inject malicious scripts to execute malicious code on pages accessed by users. 14. Exploitation Method: Via the shortcode. 15. Exploitation Prerequisites: Requires Contributor-level access permissions. 16. Exploitation Consequences: May lead to sensitive information disclosure, data tampering, or website compromise. 17. Remediation Advice: Recommend uninstalling the affected plugin and seeking alternatives. 18. Exploitation Tools: No specific exploitation tools provided. 19. Exploitation Examples: No specific exploitation examples provided. 20. Exploitation Code: No specific exploitation code provided. 21. Exploitation Steps: No specific exploitation steps provided. 22. Exploitation Environment: No specific exploitation environment provided. 23. Exploitation Scope: No specific exploitation scope provided. 24. Exploitation Frequency: No specific exploitation frequency provided. 25. Exploitation Difficulty: No specific exploitation difficulty provided. 26. Exploitation Success Rate: No specific exploitation success rate provided. 27. Exploitation Effect: No specific exploitation effect provided. 28. Exploitation Impact: No specific exploitation impact provided. 29. Exploitation Impact Scope: No specific exploitation impact scope provided. 30. Exploitation Impact Severity: No specific exploitation impact severity provided. 31. Exploitation Impact Duration: No specific exploitation impact duration provided. 32. Exploitation Impact Location: No specific exploitation impact location provided. 33. Exploitation Impact Target Group: No specific exploitation impact target group provided. 34. Exploitation Impact Industry: No specific exploitation impact industry provided. 35. Exploitation Impact Domain: No specific exploitation impact domain provided. 36. Exploitation Impact Domain: No specific exploitation impact domain provided. 37. Exploitation Impact Domain: No specific exploitation impact domain provided. 38. Exploitation Impact Domain: No specific exploitation impact domain provided. 39. Exploitation Impact Domain: No specific exploitation impact domain provided. 40. Exploitation Impact Domain: No specific exploitation impact domain provided. 41. Exploitation Impact Domain: No specific exploitation impact domain provided. 42. Exploitation Impact Domain: No specific exploitation impact domain provided. 43. Exploitation Impact Domain: No specific exploitation impact domain provided. 44. Exploitation Impact Domain: No specific exploitation impact domain provided. 45. Exploitation Impact Domain: No specific exploitation impact domain provided. 46. Exploitation Impact Domain: No specific exploitation impact domain provided. 47. Exploitation Impact Domain: No specific exploitation impact domain provided. 48. Exploitation Impact Domain: No specific exploitation impact domain provided. 49. Exploitation Impact Domain: No specific exploitation impact domain provided. 50. Exploitation Impact Domain: No specific exploitation impact domain provided. 51. Exploitation Impact Domain: No specific exploitation impact domain provided. 52. Exploitation Impact Domain: No specific exploitation impact domain provided. 53. Exploitation Impact Domain: No specific exploitation impact domain provided. 54. Exploitation Impact Domain: No specific exploitation impact domain provided. 55. Exploitation Impact Domain: No specific exploitation impact domain provided. 56. Exploitation Impact Domain: No specific exploitation impact domain provided. 57. Exploitation Impact Domain: No specific exploitation impact domain provided. 58. Exploitation Impact Domain: No specific exploitation impact domain provided. 59. Exploitation Impact Domain: No specific exploitation impact domain provided. 60. Exploitation Impact Domain: No specific exploitation impact domain provided. 61. Exploitation Impact Domain: No specific exploitation impact

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Social Proof <=2.2.4 Authenticated Stored XSS via spslider-block Shortcode

More from this source