Codepen Embedded Pen Shortcode Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Chris Coyier CodePen Embedded Pens Shortcode allows Stored XSS.This issue affects CodePen Embedded Pens Shortcode: from n/a through 1.0.2.

Affected:

up to 1.0.3

Fixed in:

1.0.3

Disclosed:

Oct 28, 2024

CVE-2024-50440 on NVD →

The CodePen Embedded Pens Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web s...

CVSS:

6.4

Affected:

up to 1.0.2

Fixed in:

1.0.3

Disclosed:

Oct 24, 2024

CVE-2024-50440 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Chris Coyier CodePen Embedded Pens Shortcode allows Stored XSS.This issue affects CodePen Embedded Pens Shortcode: from n/a through 1.0.0.

Affected:

up to 1.0.1

Fixed in:

1.0.1

Disclosed:

Jul 20, 2024

CVE-2024-37960 on NVD →

The CodePen Embedded Pens Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web s...

CVSS:

6.4

Affected:

up to 1.0.0

Fixed in:

1.0.1

Disclosed:

Jul 10, 2024

CVE-2024-37960 on NVD →