Flexi Quote Rotator Vulnerabilities

The Flexi Quote Rotator WordPress plugin through 0.9.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS:

5.5

Affected:

up to 0.9.4

Fix:

No patched version reported

Disclosed:

Jul 6, 2022

The Flexi Quote Rotator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 0.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject a...

CVSS:

4.4

Affected:

up to 0.9.4

Fix:

No patched version reported

Disclosed:

Jul 6, 2022

CVE-2022-2328 on NVD →