Shortcode For Current Date Vulnerabilities

The Shortcode For Current Date plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its attributes in versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute...

CVSS:

6.4

Affected:

up to 2.1.6

Fixed in:

2.1.7

Disclosed:

Jul 7, 2022

Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by Ryan Dewhurst in WordPress Shortcode For Current Date plugin (versions <= 2.1.6). No patched version available.

Affected:

up to 2.1.7

Fixed in:

2.1.7

Disclosed:

Jul 7, 2022

The Shortcode For Current Date plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its attributes in versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute...

Affected:

up to 2.1.7

Fixed in:

2.1.7

Disclosed:

Jul 7, 2022

The Shortcode for Current Date WordPress plugin is vulnerable to Stored Cross-Site Scripting via Shortcodes due to missing sanitization on attribute values.

CVSS:

6.4

Affected:

up to 2.1.4

Fixed in:

2.1.5

Disclosed:

Apr 5, 2022

The Shortcode for Current Date WordPress plugin is vulnerable to Stored Cross-Site Scripting via Shortcodes due to missing sanitization on attribute values.

Affected:

up to 2.1.5

Fixed in:

2.1.5

Disclosed:

Apr 5, 2022

The plugin does not escape the some of its shortcode&#039;s attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks

Affected:

up to 2.1.7

Fixed in:

2.1.7