Dirtysuds Embed Pdf Vulnerabilities

[en] The Embed PDF WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affected:

up to 1.0.6

Fix:

No patched version reported

Disclosed:

Feb 27, 2023

CVE-2022-4788 on NVD →

Deactivate and delete. This plugin has been closed as of January 3, 2023 and is not available for download. This closure is temporary, pending a full review. WordfenceTeam discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Embed PDF Plugin. This could allow a malicious actor to inject ma...

Affected:

up to 1.0.6

Fix:

No patched version reported

Disclosed:

Jan 5, 2023

The Embed PDF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes such as 'style'. This makes it possible for authenticated attackers with contributor...

CVSS:

6.4

Affected:

up to 1.0.6

Fix:

No patched version reported

Disclosed:

Jan 4, 2023

CVE-2022-4788 on NVD →

The Embed PDF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes such as 'style'. This makes it possible for authenticated attackers with contributor...

Affected:

up to 1.0.6

Fix:

No patched version reported

Disclosed:

Jan 4, 2023