Content Cards Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arunas Liuiza Content Cards allows Stored XSS.This issue affects Content Cards: from n/a through 0.9.7.

Affected:

up to 0.9.7

Fix:

No patched version reported

Disclosed:

Feb 12, 2024

CVE-2024-24928 on NVD →

The Content Cards plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 0.9.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level...

CVSS:

6.4

Affected:

up to 0.9.7

Fix:

No patched version reported

Disclosed:

Feb 9, 2024

CVE-2024-24928 on NVD →

A cross site scripting vulnerability was found in WordPress Content Cards plugin in 0.9.6 version. This vulnerability is related to OpenGraph Data Handler functionality. The data is not sanitized properly and it leads to a cross site scripting vulnerability.

Affected:

up to 0.9.7

Fixed in:

0.9.7

Disclosed:

Dec 4, 2017

[en] Cross-site scripting (XSS) vulnerability in the Content Cards plugin before 0.9.7 for WordPress allows remote attackers to inject arbitrary JavaScript via crafted OpenGraph data.

Affected:

up to 0.9.7

Fixed in:

0.9.7

Disclosed:

Dec 3, 2017

CVE-2017-17096 on NVD →

Cross-site scripting (XSS) vulnerability in the Content Cards plugin before 0.9.7 for WordPress allows remote attackers to inject arbitrary JavaScript via crafted OpenGraph data.

CVSS:

6.1

Affected:

up to 0.9.6

Fixed in:

0.9.7

Disclosed:

Nov 6, 2017

CVE-2017-17096 on NVD →