Easy Custom Js And Css Vulnerabilities

The Easy Custom JS And CSS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVSS:

6.1

Affected:

up to 1.1.2

Fix:

No patched version reported

Disclosed:

Oct 11, 2021

Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScanTeam in WordPress Easy Custom Js And Css plugin (versions <= 1.1.2).

Affected:

up to 1.1.2

Fix:

No patched version reported

Disclosed:

Oct 11, 2021

The Easy Custom JS And CSS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

Affected:

up to 1.1.2

Fix:

No patched version reported

Disclosed:

Oct 11, 2021

Most plugins (both free and premium) from the Avirtum author do not escape a page parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting issues. The issues were reported to the vendor on August 4th, 2021

Affected:

up to 1.1.2

Fix:

No patched version reported