Algori Pdf Viewer Vulnerabilities

The Algori PDF Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to the use of a vulnerable version of pdf.js in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access a...

CVSS:

6.4

Affected:

up to 1.0.7

Fixed in:

1.0.8

Disclosed:

Nov 8, 2024

CVE-2018-5158 on NVD →

[en] The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability affects Firefox ESR < 52.8 and Firefox < 60.

Affected:

up to 1.0.8

Fixed in:

1.0.8

Disclosed:

Jun 11, 2018

CVE-2018-5158 on NVD →