Shortcode Gallery For Matterport Showcase Vulnerabilities

The WP Matterport Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.9. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown action granted they can trick...

CVSS:

4.3

Affected:

up to 2.1.9

Fixed in:

2.2.0

Disclosed:

Apr 11, 2024

CVE-2024-32109 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Julien Berthelot / MPEmbed.Com WP Matterport Shortcode allows Cross Site Request Forgery.This issue affects WP Matterport Shortcode: from n/a through 2.1.9.

Affected:

up to 2.2.0

Fixed in:

2.2.0

Disclosed:

Apr 11, 2024

CVE-2024-32109 on NVD →

[en] The WP Matterport Shortcode WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affected:

up to 2.1.8

Fixed in:

2.1.8

Disclosed:

Oct 16, 2023

CVE-2023-4289 on NVD →

[en] The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin

Affected:

up to 2.1.7

Fixed in:

2.1.7

Disclosed:

Oct 16, 2023

CVE-2023-4290 on NVD →

The WP Matterport Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contribu...

CVSS:

6.4

Affected:

up to 2.1.7

Fixed in:

2.1.8

Disclosed:

Sep 25, 2023

CVE-2023-4289 on NVD →

The WP Matterport Shortcode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the use of PHP_SELF in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages t...

CVSS:

6.1

Affected:

up to 2.1.5

Fixed in:

2.1.6

Disclosed:

Sep 25, 2023

CVE-2023-4290 on NVD →

[en] Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Julien Berthelot / MPEmbed WP Matterport Shortcode plugin <= 2.1.4 versions.

Affected:

up to 2.1.5

Fixed in:

2.1.5

Disclosed:

Aug 30, 2023

CVE-2023-35094 on NVD →

The WP Matterport Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'matterport' shortcode in versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributo...

CVSS:

6.4

Affected:

up to 2.1.4

Fixed in:

2.1.5

Disclosed:

Jun 15, 2023

CVE-2023-35094 on NVD →